@serverkgg/bridge 0.1.7 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@serverkgg/bridge",
-	"version": "0.1.7",
+	"version": "0.1.9",
 	"description": "Serverk game bridge and driver runtime, wire protocol, manifest schema, and maintainer CLI",
 	"homepage": "https://serverk.gg",
 	"license": "SEE LICENSE IN LICENSE.md",

package/rules/package.md

@@ -51,10 +51,12 @@ One Serverk package (a game or a bot runtime) on `@serverkgg/bridge`, with no pi
 - Write `ar:` before `en:` in every localized field.
 - `secrets` are platform API keys the game can use, `required: false`; customer settings are a panel form, and a bot customer's own values go through `environment.vault`.
 - Change an outcome by changing the declared value (`reset.keep: []`, `backup.only`), never by asking the platform to ignore a field.
+- `files.protected` holds only `.serverk` paths: the stamp, sidecars, journals and driver scratch under `.serverk-staging/`. Never a drop point under `.serverk-uploads/`, a `files.notable` match, an `@[open](files:…)` target or a folder the customer collects a file from; `serverk-bridge validate` fails each but the last, a runtime path.
 
 ## Guides and image
 
 - A guide is `guides/<id>/ar.md` and `en.md`, starting at `##` with no `#` title; its title and summary live in `serverk.yml`. Every package has a `getting-started` guide tagged `start`.
+- A heading may end with `{#<id>}`, lowercase letters, digits and single hyphens, to fix its anchor. A bot package's `errors` guide gives each cause section its cause id, the same in both languages. Why: the panel links every named cause to `errors#<cause id>`.
 - `image/Dockerfile` keeps the shared contract: `ARG BRIDGE_VERSION` with `LABEL gg.serverk.bridge.version`, a `container` user with uid 1000 and home `/home/container`, `COPY dist/bridge /serverk/bridge`, `ENTRYPOINT ["/usr/bin/tini", "--", "/serverk/bridge"]`, and no `USER` line. Game files download at install, a bot's code arrives with a deploy; neither is baked in.
 - The outermost start wrapper ends in `exec`, with no `setsid`, `nohup` or double fork. Why: the bridge checks the uid of the pid it spawned, and stop escalation signals the process group, so an orphan outside it keeps the port.
 

package/src/bot/botCauses.test.ts

@@ -29,6 +29,10 @@ const CASES: readonly {
 		line: "telegram.error.InvalidToken: The token `123:abc` was rejected by the server.",
 		cause: BridgeCrashCause.TokenInvalid,
 	},
+	{
+		line: "telegram.error.InvalidToken: You must pass the token you received from https://t.me/Botfather!",
+		cause: BridgeCrashCause.TokenInvalid,
+	},
 	{
 		line: "GrammyError: Call to 'deleteWebhook' failed! (404: Not Found)",
 		cause: BridgeCrashCause.TokenInvalid,
@@ -165,6 +169,10 @@ const CASES: readonly {
 		line: "ModuleNotFoundError: No module named 'audioop'",
 		cause: BridgeCrashCause.AudioopRemoved,
 	},
+	{
+		line: "KeyError: 'TELEGRAM_TOKEN'",
+		cause: BridgeCrashCause.VariableMissing,
+	},
 	{
 		line: "discord.errors.HTTPException: 429 Too Many Requests (error code: 0): You are being blocked from accessing our API temporarily due to exceeding our rate limits frequently.",
 		cause: BridgeCrashCause.RateLimited,
@@ -253,6 +261,30 @@ describe("BOT_CRASH_EVIDENCE", () => {
 		});
 	}
 
+	it("names the variable the code read from an empty vault", () => {
+		const { ring, print } = botRing();
+
+		print("KeyError: 'TELEGRAM_TOKEN'");
+
+		expect(ring.crash(recordOf())).toBe(BridgeCrashCause.VariableMissing);
+		expect(ring.drain(0).events.at(0)?.payload?.variable).toBe("TELEGRAM_TOKEN");
+	});
+
+	for (const line of [
+		"KeyError: 0",
+		"KeyError: 'user'",
+		"KeyError: 'X'",
+	]) {
+		it(`leaves a key that is not a variable name unexplained from "${line}"`, () => {
+			const { ring, print } = botRing();
+
+			print(line);
+
+			expect(ring.crash(recordOf())).toBe(BridgeCrashCause.Unknown);
+			expect(ring.drain(0).events.at(0)?.payload?.variable).toBeUndefined();
+		});
+	}
+
 	it("names the removed audioop module before any other missing module", () => {
 		const { ring, print } = botRing();
 

package/src/bot/botCauses.ts

@@ -48,6 +48,10 @@ export const BOT_CRASH_EVIDENCE: readonly BridgeEventPattern[] = [
 		match: /ffmpeg was not found|\bENOENT\b.*\bffmpeg\b|\bffmpeg\b.*\bENOENT\b/i,
 		emit: BridgeEventName.FfmpegMissing,
 	},
+	{
+		match: /^KeyError: '(?<variable>[A-Z][A-Z0-9_]{1,63})'\s*$/,
+		emit: BridgeEventName.VariableMissing,
+	},
 	{
 		match: /No module named 'audioop'/,
 		emit: BridgeEventName.AudioopRemoved,

package/src/bot/botDeploy.test.ts

@@ -8,8 +8,10 @@ import {
 	DEPLOY_MARKER_DRAFT,
 	DEPLOYMENT_EVENT_PATTERN,
 	DEPLOYMENT_LINE,
+	DEPLOYMENT_STAGE_LINE,
 	type DeployMarker,
 	deploymentLine,
+	deploymentStageLine,
 	deployPending,
 	pendingDeploymentOf,
 	requestDeploy,
@@ -216,6 +218,36 @@ describe("deploymentLine", () => {
 	});
 });
 
+describe("deploymentStageLine", () => {
+	it("names the deployment and the stage it entered", () => {
+		expect(deploymentStageLine("dep_a1b2c3d4", BotDeploymentStage.Install)).toBe(
+			"serverk: deployment dep_a1b2c3d4 stage install",
+		);
+	});
+
+	it("round-trips through the stage pattern for every stage", () => {
+		for (const stage of Object.values(BotDeploymentStage)) {
+			expect(DEPLOYMENT_STAGE_LINE.exec(deploymentStageLine("dep_a1b2c3d4", stage))?.groups).toEqual({
+				deployment: "dep_a1b2c3d4",
+				stage,
+			});
+		}
+	});
+
+	it("is never read as a deployment outcome, so it raises no event", () => {
+		const line = deploymentStageLine("dep_a1b2c3d4", BotDeploymentStage.Start);
+
+		expect(DEPLOYMENT_LINE.test(line)).toBe(false);
+		expect(DEPLOYMENT_EVENT_PATTERN.match.test(line)).toBe(false);
+		expect(DEPLOYMENT_STAGE_LINE.test("serverk: deployment dep_a1b2c3d4 ready")).toBe(false);
+	});
+
+	it("reads only deployment ids of at most 64 characters", () => {
+		expect(DEPLOYMENT_STAGE_LINE.test(`serverk: deployment ${"d".repeat(64)} stage sync`)).toBe(true);
+		expect(DEPLOYMENT_STAGE_LINE.test(`serverk: deployment ${"d".repeat(65)} stage sync`)).toBe(false);
+	});
+});
+
 describe("requestDeploy", () => {
 	it("writes the request as JSON and restarts a running bot", async () => {
 		const { context, stored, events } = deployContext(true);

package/src/bot/botDeploy.ts

@@ -21,6 +21,8 @@ export const DEPLOYMENT_EVENT_KIND = "deployment";
 export const DEPLOYMENT_LINE =
 	/^serverk: deployment (?<deployment>\S{1,64}) (?<outcome>ready|failed)(?: at (?<commit>[0-9a-f]{7,64}))?(?:: (?<stage>[a-z-]+): (?<detail>.{1,200}))?$/u;
 
+export const DEPLOYMENT_STAGE_LINE = /^serverk: deployment (?<deployment>\S{1,64}) stage (?<stage>[a-z-]+)$/u;
+
 export const DEPLOYMENT_DETAIL_LIMIT = 200;
 
 export const DEPLOYMENT_COMMIT_LENGTH = 12;
@@ -64,6 +66,10 @@ export const deploymentLine = (input: DeploymentLineInput) => {
 	return `serverk: deployment ${input.deployment} failed: ${input.stage}: ${detail}`;
 };
 
+export const deploymentStageLine = (deployment: string, stage: BotDeploymentStage) => {
+	return `serverk: deployment ${deployment} stage ${stage}`;
+};
+
 export const DEPLOYMENT_EVENT_PATTERN: BridgeEventPattern = {
 	match: DEPLOYMENT_LINE,
 	emit: BridgeEventName.ServerUpdated,

package/src/bot/detect/corpus/mruniquehacker-knightbot-md.json

@@ -0,0 +1,35 @@
+{
+	"source": {
+		"url": "https://github.com/mruniquehacker/Knightbot-MD",
+		"branch": "main",
+		"commit": "871bce832169c3a52a632dc100c1f235cb35977c",
+		"stars": 8128
+	},
+	"files": [
+		".gitignore",
+		"README.md",
+		"config.js",
+		"index.js",
+		"main.js",
+		"package.json",
+		"settings.js"
+	],
+	"contents": {
+		"package.json": "{\n  \"name\": \"knightbot\",\n  \"version\": \"1.0.0\",\n  \"description\": \"WhatsApp Bot\",\n  \"main\": \"index.js\",\n  \"scripts\": {\n    \"start\": \"node index.js\",\n    \"start:optimized\": \"node --max-old-space-size=512 --optimize-for-size --gc-interval=100 index.js\",\n    \"cleanup\": \"node cleanup.js\",\n    \"reset-session\": \"node reset-session.js\",\n    \"start:clean\": \"npm run cleanup && npm run start:optimized\",\n    \"start:fresh\": \"npm run reset-session && npm start\",\n    \"install:panel\": \"npm install --legacy-peer-deps\",\n    \"install:force\": \"npm install --force\",\n    \"test\": \"echo \\\"Error: no test specified\\\" && exit 1\",\n    \"docker:build\": \"docker build -t docker run -e SESSION_ID=$SESSION_ID knightbot\"\n  },\n  \"keywords\": [\n    \"whatsapp-bot\"\n  ],\n  \"author\": \"\",\n  \"license\": \"ISC\",\n  \"dependencies\": {\n    \"@adiwajshing/keyed-db\": \"^0.2.4\",\n    \"@ffmpeg/ffmpeg\": \"^0.12.15\",\n    \"@hapi/boom\": \"^10.0.1\",\n    \"@types/node\": \"^18.0.6\",\n    \"@whiskeysockets/baileys\": \"^v7.0.0-rc.9\",\n    \"awesome-phonenumber\": \"^5.9.0\",\n    \"axios\": \"^1.8.4\",\n    \"chalk\": \"^4.1.2\",\n    \"cheerio\": \"^1.0.0-rc.12\",\n    \"cookie\": \"^0.5.0\",\n    \"dotenv\": \"^16.4.5\",\n    \"events\": \"^3.3.0\",\n    \"file-type\": \"^16.5.4\",\n    \"fluent-ffmpeg\": \"^2.1.3\",\n    \"form-data\": \"^4.0.1\",\n    \"fs-extra\": \"^11.2.0\",\n    \"gtts\": \"^0.2.1\",\n    \"human-readable\": \"^0.2.1\",\n    \"jimp\": \"^1.6.0\",\n    \"jsdom\": \"^22.1.0\",\n    \"libphonenumber-js\": \"^1.11.18\",\n    \"libsignal\": \"^2.0.1\",\n    \"link-preview-js\": \"^3.0.5\",\n    \"moment-timezone\": \"^0.5.43\",\n    \"mumaker\": \"^2.0.0\",\n    \"node-cache\": \"^5.1.2\",\n    \"node-fetch\": \"^2.7.0\",\n    \"node-id3\": \"^0.2.3\",\n    \"node-webpmux\": \"^3.1.0\",\n    \"node-youtube-music\": \"^0.8.3\",\n    \"performance-now\": \"^2.1.0\",\n    \"phin\": \"^3.7.1\",\n    \"pino\": \"^8.21.0\",\n    \"qrcode\": \"^1.5.4\",\n    \"qrcode-reader\": \"^1.0.4\",\n    \"qrcode-terminal\": \"^0.12.0\",\n    \"request\": \"^2.88.2\",\n    \"ruhend-scraper\": \"^8.3.0\",\n    \"safe-stable-stringify\": \"^2.5.0\",\n    \"set-cookie\": \"^0.0.4\",\n    \"sharp\": \"^0.32.6\",\n    \"tough-cookie\": \"^5.0.0\",\n    \"translate-google-api\": \"^1.0.4\",\n    \"ws\": \"^8.17.1\",\n    \"yargs\": \"^17.6.0\",\n    \"yargs-parser\": \"^21.1.1\",\n    \"youtube-yts\": \"^2.0.0\",\n    \"youtubedl-core\": \"^4.11.7\",\n    \"yt-search\": \"^2.12.1\",\n    \"ytdl-core\": \"^4.11.5\"\n  },\n  \"overrides\": {\n    \"jimp\": \"^1.6.0\"\n  },\n  \"engines\": {\n    \"node\": \">=18.0.0\"\n  }\n}\n"
+	},
+	"expected": {
+		"runtime": "node",
+		"packageManager": "npm",
+		"framework": null,
+		"platform": null,
+		"install": "npm install",
+		"build": null,
+		"start": "node index.js",
+		"nodeVersion": "18",
+		"pythonVersion": null,
+		"tokenKey": null,
+		"warnings": [
+			"no-lockfile"
+		]
+	}
+}

package/src/cli/validate.test.ts

@@ -4,9 +4,9 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { renderDetectTable } from "../bot/detect";
 import { BridgeKind, BridgeSetupStepKind } from "../core";
-import { GuideOpenTab } from "../guides";
-import { MANIFEST_SCHEMA_VERSION, PackageKind } from "../manifest";
-import type { BridgeDriver, BridgeSetupModule } from "../modules";
+import { GuideOpenTab, type GuidePack, type ParsedBlock, type ParsedLeafBlock } from "../guides";
+import { MANIFEST_SCHEMA_VERSION, PackageKind, type RunnableManifest } from "../manifest";
+import type { BridgeDriver, BridgePendingModule, BridgeSetupModule } from "../modules";
 import {
 	type BridgeCatalogSection,
 	BridgeConfirm,
@@ -23,9 +23,13 @@ import { RULES_FILE, readShippedRules, writeRules } from "./rules";
 import {
 	availabilityReportLines,
 	confirmReportLines,
+	notableReportLines,
+	openTargetReportLines,
 	placementReportLines,
+	protectedNameReportLines,
 	runValidate,
 	setupReportLines,
+	uploadStagingReportLines,
 } from "./validate";
 
 const text = (value: string) => ({
@@ -822,3 +826,425 @@ describe("the confirm report", () => {
 		).toEqual([]);
 	});
 });
+
+const manifestWith = (rules: string[], notes: string[] = []) => {
+	return {
+		files: {
+			protected: rules,
+			notable: notes.map((match) => ({
+				match,
+			})),
+		},
+	} as unknown as RunnableManifest;
+};
+
+const worldsWith = (staging: string): BridgeTableSection => ({
+	layout: BridgeLayout.Table,
+	id: "worlds",
+	module: "worlds",
+	columns: [
+		{
+			key: "name",
+			label: text("Name"),
+		},
+	],
+	upload: {
+		label: text("Upload a world"),
+		extensions: [
+			"zip",
+		],
+		staging,
+	},
+});
+
+const pendingWith = (staging: string): BridgePendingModule => ({
+	kind: BridgeKind.Pending,
+	staging,
+	extensions: [
+		"jar",
+	],
+	list: async () => [],
+	add: async () => {
+		return;
+	},
+});
+
+const driverWith = (
+	sections: BridgeTab["sections"],
+	pending?: BridgePendingModule,
+	setup?: BridgeSetupModule,
+): BridgeDriver => ({
+	install: {
+		kind: BridgeKind.Install,
+		run: async () => {
+			return;
+		},
+	},
+	lifecycle: {
+		kind: BridgeKind.Lifecycle,
+		command: async () => [
+			"run",
+		],
+	},
+	pending,
+	setup,
+	panel: {
+		tabs: [
+			{
+				id: "worlds",
+				title: text("Worlds"),
+				sections,
+			},
+		],
+	},
+});
+
+const packWith = (blocks: ParsedBlock[]): GuidePack => ({
+	drafts: [
+		{
+			id: "getting-started",
+			title: text("Getting started"),
+			summary: text("Start here"),
+			tags: [],
+			surfaces: [],
+			videoId: null,
+			body: {
+				ar: blocks,
+				en: blocks,
+			},
+		},
+	],
+	files: [],
+	images: [],
+	commands: [],
+});
+
+const filesOpenWith = (path: string | null): ParsedLeafBlock => ({
+	type: "open",
+	target: {
+		tab: GuideOpenTab.Files,
+		path,
+	},
+});
+
+const SERVERK_RULES = [
+	".serverk-install.json",
+	".serverk/**",
+	"plugins/.serverk-catalog.json",
+	".serverk-staging/**",
+	".serverk-wipe",
+	"Server/mods/.serverk-mods.json",
+];
+
+const FOREIGN_RULES = [
+	"bedrock_server",
+	"*.so",
+	"worlds/*/db/**",
+	"config",
+	".serverkfoo",
+];
+
+const JAVA_RULES = [
+	".serverk-install.json",
+	".serverk-crashscan.json",
+	".serverk-companions.json",
+	".serverk-modpack.json",
+	"plugins/.serverk-catalog.json",
+	"mods/.serverk-catalog.json",
+];
+
+describe("protectedNameReportLines", () => {
+	it("passes rules that each name a .serverk path", () => {
+		expect(protectedNameReportLines(manifestWith(SERVERK_RULES))).toEqual([]);
+	});
+
+	for (const rule of FOREIGN_RULES) {
+		it(`fails "${rule}", which names no .serverk path`, () => {
+			expect(
+				protectedNameReportLines(
+					manifestWith([
+						".serverk-install.json",
+						rule,
+					]),
+				),
+			).toEqual([
+				`  error: files.protected "${rule}" is not a .serverk path — a package protects only platform state, so drop the rule or move the file under a .serverk name`,
+			]);
+		});
+	}
+});
+
+describe("uploadStagingReportLines", () => {
+	it("fails a section upload that stages under a protected folder", () => {
+		const manifest = manifestWith([
+			".serverk-download/**",
+			".serverk-worlds/**",
+		]);
+
+		expect(
+			uploadStagingReportLines(
+				manifest,
+				driverWith([
+					worldsWith(".serverk-worlds"),
+				]),
+			),
+		).toEqual([
+			'  error: upload staging ".serverk-worlds" of tab "worlds" section "worlds" is protected by ".serverk-worlds/**" — a protected path refuses the customer\'s upload, so take the folder off `files.protected`',
+		]);
+	});
+
+	it("fails a pending upload that stages under a protected folder", () => {
+		const manifest = manifestWith([
+			".serverk-staging",
+		]);
+
+		expect(uploadStagingReportLines(manifest, driverWith([], pendingWith(".serverk-staging/pending-upload")))).toEqual([
+			'  error: upload staging ".serverk-staging/pending-upload" of the pending upload is protected by ".serverk-staging" — a protected path refuses the customer\'s upload, so take the folder off `files.protected`',
+		]);
+	});
+
+	it("passes when no protected rule reaches an upload staging folder", () => {
+		const manifest = manifestWith([
+			".serverk-download/**",
+			".serverk-install.json",
+			".serverk-staging/install/**",
+			"*.json",
+		]);
+
+		expect(
+			uploadStagingReportLines(
+				manifest,
+				driverWith(
+					[
+						worldsWith(".serverk-staging/world-upload"),
+					],
+					pendingWith(".serverk-staging/pending-upload"),
+				),
+			),
+		).toEqual([]);
+	});
+
+	it("passes an upload staging folder that sits beside a protected sibling", () => {
+		const manifest = manifestWith([
+			".serverk-staging/**",
+		]);
+
+		expect(
+			uploadStagingReportLines(
+				manifest,
+				driverWith([
+					worldsWith(".serverk-uploads/world"),
+				]),
+			),
+		).toEqual([]);
+	});
+
+	it("passes a staging folder that merely holds a protected sidecar", () => {
+		const manifest = manifestWith([
+			".serverk-staging/install/**",
+		]);
+
+		expect(
+			uploadStagingReportLines(
+				manifest,
+				driverWith([
+					worldsWith(".serverk-staging"),
+				]),
+			),
+		).toEqual([]);
+	});
+});
+
+describe("notableReportLines", () => {
+	it("fails a note on a protected file", () => {
+		const manifest = manifestWith(
+			[
+				".serverk-install.json",
+			],
+			[
+				".serverk-install.json",
+			],
+		);
+
+		expect(notableReportLines(manifest)).toEqual([
+			'  error: files.notable ".serverk-install.json" is protected by ".serverk-install.json" — the file manager hides a protected path before it annotates it, so the note never shows; take one of the two off',
+		]);
+	});
+
+	it("fails a note on a file inside a protected folder", () => {
+		const manifest = manifestWith(
+			[
+				".serverk/**",
+			],
+			[
+				".serverk/install.json",
+			],
+		);
+
+		expect(notableReportLines(manifest)).toEqual([
+			'  error: files.notable ".serverk/install.json" is protected by ".serverk/**" — the file manager hides a protected path before it annotates it, so the note never shows; take one of the two off',
+		]);
+	});
+
+	it("fails a wildcard note under a protected folder", () => {
+		const manifest = manifestWith(
+			[
+				".serverk-staging",
+			],
+			[
+				".serverk-staging/**",
+			],
+		);
+
+		expect(notableReportLines(manifest)).toEqual([
+			'  error: files.notable ".serverk-staging/**" is protected by ".serverk-staging" — the file manager hides a protected path before it annotates it, so the note never shows; take one of the two off',
+		]);
+	});
+
+	it("passes notes on folders that merely hold protected sidecars", () => {
+		const manifest = manifestWith(JAVA_RULES, [
+			"plugins",
+			"mods",
+			"world/**",
+			"*.json",
+		]);
+
+		expect(notableReportLines(manifest)).toEqual([]);
+	});
+});
+
+describe("openTargetReportLines", () => {
+	it("fails a guide link that opens a protected file", () => {
+		const manifest = manifestWith([
+			".serverk-install.json",
+		]);
+
+		expect(
+			openTargetReportLines(
+				manifest,
+				driverWith([]),
+				packWith([
+					filesOpenWith(".serverk-install.json"),
+				]),
+			),
+		).toEqual([
+			'  error: guide "getting-started" (ar) opens files at ".serverk-install.json", which ".serverk-install.json" protects — the panel refuses a protected path, so the link is dead; point it elsewhere or take the rule off `files.protected`',
+			'  error: guide "getting-started" (en) opens files at ".serverk-install.json", which ".serverk-install.json" protects — the panel refuses a protected path, so the link is dead; point it elsewhere or take the rule off `files.protected`',
+		]);
+	});
+
+	it("fails a guide link inside a conditional block", () => {
+		const manifest = manifestWith([
+			".serverk/**",
+		]);
+
+		expect(
+			openTargetReportLines(
+				manifest,
+				driverWith([]),
+				packWith([
+					{
+						type: "conditional",
+						key: "panel.modded",
+						when: [],
+						otherwise: [
+							filesOpenWith(".serverk/install.json"),
+						],
+					},
+				]),
+			),
+		).toEqual([
+			'  error: guide "getting-started" (ar) opens files at ".serverk/install.json", which ".serverk/**" protects — the panel refuses a protected path, so the link is dead; point it elsewhere or take the rule off `files.protected`',
+			'  error: guide "getting-started" (en) opens files at ".serverk/install.json", which ".serverk/**" protects — the panel refuses a protected path, so the link is dead; point it elsewhere or take the rule off `files.protected`',
+		]);
+	});
+
+	it("fails a setup step that opens a protected folder", () => {
+		const manifest = manifestWith([
+			".serverk-level/**",
+		]);
+
+		const setup: BridgeSetupModule = {
+			kind: BridgeKind.Setup,
+			steps: [
+				{
+					kind: BridgeSetupStepKind.Open,
+					id: "level",
+					title: text("Level"),
+					required: false,
+					target: {
+						tab: GuideOpenTab.Files,
+						path: ".serverk-level",
+					},
+				},
+			],
+			submit: async () => {
+				return;
+			},
+		};
+
+		expect(openTargetReportLines(manifest, driverWith([], undefined, setup), null)).toEqual([
+			'  error: setup step "level" opens files at ".serverk-level", which ".serverk-level/**" protects — the panel refuses a protected path, so the link is dead; point it elsewhere or take the rule off `files.protected`',
+		]);
+	});
+
+	it("passes files links with no path, other tabs and unprotected paths", () => {
+		const manifest = manifestWith([
+			".serverk-install.json",
+			".serverk-staging/**",
+		]);
+
+		const setup: BridgeSetupModule = {
+			kind: BridgeKind.Setup,
+			steps: [
+				{
+					kind: BridgeSetupStepKind.Open,
+					id: "files",
+					title: text("Files"),
+					required: false,
+					target: {
+						tab: GuideOpenTab.Files,
+						path: null,
+					},
+				},
+				{
+					kind: BridgeSetupStepKind.Open,
+					id: "invite",
+					title: text("Invite"),
+					required: false,
+					target: {
+						tab: GuideOpenTab.Access,
+					},
+				},
+			],
+			submit: async () => {
+				return;
+			},
+		};
+
+		expect(
+			openTargetReportLines(
+				manifest,
+				driverWith([], undefined, setup),
+				packWith([
+					filesOpenWith(null),
+					filesOpenWith("server.properties"),
+					filesOpenWith(".serverk-uploads/world"),
+					{
+						type: "open",
+						target: {
+							tab: GuideOpenTab.Panel,
+							tabId: "settings",
+						},
+					},
+					{
+						type: "open",
+						target: {
+							tab: GuideOpenTab.Console,
+						},
+					},
+				]),
+			),
+		).toEqual([]);
+	});
+});