@specific.dev/spectest 0.47.0 → 0.49.0

package/src/daemon.ts

@@ -57,6 +57,7 @@ import {
   sanitizeSegment,
 } from "./harness/volume-paths.js";
 import { pollUntilReady } from "./harness/ready-poll.js";
+import { APP_DIR, WORKSPACE, resolveProjectPath } from "./project-files.js";
 import {
   isTextualContentType,
   looksBinary,
@@ -111,7 +112,9 @@ import {
 } from "./harness/methods.js";
 import type { Mobile, MobileApp } from "./mobile.js";
 import { openTerminal } from "./terminal.js";
+import { readAnnotation, type RenderAnnotation } from "./annotate.js";
 import {
+  recordEmail,
   recordEnv,
   recordExec,
   recordFake,
@@ -180,7 +183,6 @@ function namedServices(cfg: EnvironmentConfig): NamedService[] {
 
 const DEFAULT_TEST_TIMEOUT_MS = 60_000;
 const NETWORK_NAME = process.env.SPECTEST_NETWORK ?? "spectest-net";
-const WORKSPACE = process.env.SPECTEST_WORKSPACE ?? "/workspace";
 
 // Stable hostname every service container resolves to the host (the
 // `spectest-br0` gateway) — so apps that build or pull images at runtime
@@ -207,7 +209,9 @@ function hostCacheGateway(): string | null {
   }
   return _hostCacheGateway;
 }
-const APP_DIR = process.env.SPECTEST_APP_DIR ?? "/opt/spectest/app";
+// WORKSPACE (/workspace) and APP_DIR (/opt/spectest/app) both live in
+// project-files.ts, next to the rule that decides which copy of a project
+// file is the current one.
 // The bun the base snapshot installs (base.rs::BASE_SETUP_SH). The daemon
 // runs under it, and eval's dependency install shells out to it.
 const BUN_BIN = "/usr/local/bin/bun";
@@ -1328,11 +1332,23 @@ async function runContainer(
   }
 }
 
-async function probeTcp(host: string, port: number): Promise<boolean> {
+/** What a readiness probe saw. `detail` is what the plain boolean used to
+ *  throw away, and it is the difference between the two ways a probe fails:
+ *  it ran and said no (a service that isn't up yet, a file a build never
+ *  produced) versus it never got to run (a docker daemon or a guest too
+ *  starved to answer inside the probe's own timeout). The failure message
+ *  carries the last one, since a `sleep infinity` service has no container
+ *  logs to fall back on. */
+interface ProbeOutcome {
+  ok: boolean;
+  detail: string;
+}
+
+async function probeTcp(host: string, port: number): Promise<ProbeOutcome> {
   return new Promise((resolve) => {
     const sock = net.createConnection({ host, port });
     let settled = false;
-    const finish = (v: boolean) => {
+    const finish = (ok: boolean, detail: string) => {
       if (settled) return;
       settled = true;
       try {
@@ -1340,12 +1356,16 @@ async function probeTcp(host: string, port: number): Promise<boolean> {
       } catch {
         /* ignore */
       }
-      resolve(v);
+      resolve({ ok, detail });
     };
     sock.setTimeout(2000);
-    sock.once("connect", () => finish(true));
-    sock.once("error", () => finish(false));
-    sock.once("timeout", () => finish(false));
+    sock.once("connect", () => finish(true, `connected to ${host}:${port}`));
+    sock.once("error", (err: Error) =>
+      finish(false, `connect to ${host}:${port} failed: ${err.message}`),
+    );
+    sock.once("timeout", () =>
+      finish(false, `connect to ${host}:${port} got no reply within 2000ms`),
+    );
   });
 }
 
@@ -1355,52 +1375,92 @@ async function probeHttp(
   urlPath: string,
   headers?: Record<string, string>,
   expectStatus?: number,
-): Promise<boolean> {
+): Promise<ProbeOutcome> {
+  const url = `http://${host}:${port}${urlPath}`;
   const ctrl = new AbortController();
   const to = setTimeout(() => ctrl.abort(), 5000);
   try {
-    const res = await fetch(`http://${host}:${port}${urlPath}`, {
-      signal: ctrl.signal,
-      headers,
-    });
-    return expectStatus !== undefined ? res.status === expectStatus : res.ok;
-  } catch {
-    return false;
+    const res = await fetch(url, { signal: ctrl.signal, headers });
+    const ok = expectStatus !== undefined ? res.status === expectStatus : res.ok;
+    const want = expectStatus !== undefined ? String(expectStatus) : "2xx";
+    return { ok, detail: `GET ${url} → ${res.status} (wanted ${want})` };
+  } catch (err) {
+    const e = err as Error;
+    const detail =
+      e?.name === "AbortError"
+        ? `GET ${url} got no reply within 5000ms`
+        : `GET ${url} failed: ${e?.message ?? String(err)}`;
+    return { ok: false, detail };
   } finally {
     clearTimeout(to);
   }
 }
 
-async function probeExec(name: string, command: string): Promise<boolean> {
+async function probeExec(name: string, command: string): Promise<ProbeOutcome> {
   const r = await docker(["exec", name, "sh", "-c", command], 10_000);
-  return r.code === 0;
+  if (r.code === 0) return { ok: true, detail: `\`${command}\` exited 0` };
+  // 124 is shx's own kill (see `shx`): the exec never answered, which says
+  // the docker daemon is wedged or starved rather than anything about the
+  // command's verdict.
+  const why =
+    r.code === 124
+      ? `was killed after 10000ms with no reply`
+      : `exited ${r.code}`;
+  const output = firstLine(r.stderr) || firstLine(r.stdout);
+  return {
+    ok: false,
+    detail: `\`${command}\` ${why}${output ? `: ${output}` : ""}`,
+  };
+}
+
+/** First non-empty line, trimmed and capped — probe output goes into an
+ *  error message, not a log file. */
+function firstLine(s: string): string {
+  const line = s.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "";
+  return line.length > 200 ? `${line.slice(0, 200)}…` : line;
 }
 
 async function waitForReady(svc: NamedService): Promise<void> {
   const check: ReadyCheck | undefined = svc.readyCheck;
   if (!check) return;
   const timeoutSecs = check.timeoutSecs ?? 60;
+  let last: ProbeOutcome | undefined;
   const probe = async (): Promise<boolean> => {
-    if (check.type === "tcp") return probeTcp(svc.name, check.port);
-    if (check.type === "http") {
-      return probeHttp(
+    if (check.type === "tcp") last = await probeTcp(svc.name, check.port);
+    else if (check.type === "http") {
+      last = await probeHttp(
         svc.name,
         check.port,
         check.path ?? "/",
         check.headers,
         check.expectStatus,
       );
-    }
-    return probeExec(svc.name, check.command);
+    } else last = await probeExec(svc.name, check.command);
+    return last.ok;
   };
   // Scheduling (the ramp, and not sleeping past the deadline) lives in
   // `harness/ready-poll.ts`; this supplies the probe and the diagnosis.
-  const { ready } = await pollUntilReady(probe, { kind: check.type, timeoutSecs });
+  const { ready, attempts, elapsedMs } = await pollUntilReady(probe, {
+    kind: check.type,
+    timeoutSecs,
+  });
   if (ready) return;
+  // The attempt count is half the diagnosis: a probe with a 10s timeout of
+  // its own can only run a handful of times in 60s, so "6 attempts" says the
+  // probes were hanging where "80 attempts" says they ran and kept saying no.
+  let msg =
+    `service ${svc.name} not ready within ${timeoutSecs}s ` +
+    `(${attempts} ${check.type} probe${attempts === 1 ? "" : "s"} over ${
+      Math.round(elapsedMs / 100) / 10
+    }s).`;
+  if (last) msg += `\nLast probe: ${last.detail}`;
   const logs = await docker(["logs", "--tail=200", svc.name], 30_000);
-  throw new Error(
-    `service ${svc.name} not ready within ${timeoutSecs}s. Recent container logs:\n${logs.stdout}\n${logs.stderr}`,
-  );
+  const output = `${logs.stdout}\n${logs.stderr}`.trim();
+  // A service that logs nothing (`sleep infinity`, a quiet daemon) used to
+  // get an empty "Recent container logs:" heading, which reads as if the
+  // logs were the evidence and there simply weren't any.
+  msg += output ? `\nRecent container logs:\n${output}` : `\n(the container logged nothing)`;
+  throw new Error(msg);
 }
 
 /** Validate the `dependsOn` graph and return the name→service map used to
@@ -2670,14 +2730,27 @@ function invokeFakeHelper(
   const args = callArgs.map((a) => deepUnwrap(a));
   const safeArgs = args.map((a) => safeSerialize(a));
   const recordResult = (value: unknown): unknown => {
+    // A helper may box its return in a render annotation
+    // (`annotate(v, "email", …)`). The box never reaches the test, and it
+    // never replaces the step either: the call is recorded as the ordinary
+    // `fake` event it is, and the annotation rides *under* it as a child
+    // event (`parentSeq`), which the dashboard folds into the fake step's
+    // detail panel. So the timeline reads the same as any other helper
+    // call, with the richer view one click in.
+    const annotated = readAnnotation(value);
+    const raw = annotated ? annotated.value : value;
+    const durationMs = Date.now() - t;
     const seq = recordFake({
       fake: fakeName,
       member,
       args: safeArgs,
-      result: safeSerialize(value),
-      durationMs: Date.now() - t,
+      result: safeSerialize(raw),
+      durationMs,
     }, resv);
-    return wrap(value, seq);
+    if (annotated && seq !== undefined) {
+      recordAnnotationChild(fakeName, member, annotated.annotation, durationMs, seq);
+    }
+    return wrap(raw, seq);
   };
   const recordError = (err: unknown): void => {
     recordFake({
@@ -2705,6 +2778,42 @@ function invokeFakeHelper(
   return recordResult(result);
 }
 
+/** Record a fake-helper call's render annotation as a child of the call's
+ * own `fake` event — the same `parentSeq` grouping `ctx.poll` uses for the
+ * iteration it kept, so the annotated view folds into the fake step's
+ * detail panel instead of taking a timeline row of its own.
+ *
+ * The child is the event kind that already knows how to draw this: an
+ * `email` annotation records the very event the built-in `email()`
+ * component's mailbox helpers record, so it renders with no new code. It
+ * carries the fake's name and member as its service/op, and the parent's
+ * duration, since it describes that same call.
+ *
+ * Only the success path is annotated: a helper that threw returned no value
+ * to annotate, so it's a plain `fake` error event. */
+function recordAnnotationChild(
+  fakeName: string,
+  member: string,
+  annotation: RenderAnnotation,
+  durationMs: number,
+  parentSeq: number,
+): void {
+  switch (annotation.kind) {
+    case "email":
+      recordEmail({
+        parentSeq,
+        annotation: true,
+        service: fakeName,
+        op: member,
+        message: annotation.message,
+        messages: annotation.messages,
+        count: annotation.count,
+        durationMs,
+      });
+      break;
+  }
+}
+
 function errMessage(err: unknown): string {
   return (err as Error)?.message ?? String(err);
 }
@@ -3634,8 +3743,9 @@ async function spectestContext(scope: ContextScope = {}): Promise<SpectestContex
   const execTimeoutMs = scope.service ? COMPONENT_EXEC_DEFAULT_TIMEOUT_MS : undefined;
   return {
     projectRoot: WORKSPACE,
-    readProjectFile: (p: string) =>
-      fs.readFile(path.isAbsolute(p) ? p : path.join(WORKSPACE, p), "utf8"),
+    readProjectFile: (p: string) => fs.readFile(resolveProjectPath(p), "utf8"),
+    readProjectFileBytes: async (p: string) =>
+      new Uint8Array(await fs.readFile(resolveProjectPath(p))),
     exec: (service, command, opts) =>
       componentExec(service, command, opts, execTimeoutMs),
     // Read `globalThis.fetch` at call time: the wrapper is installed for
@@ -4117,41 +4227,42 @@ async function pollCall<T>(
   let success = false;
   let predicateError: unknown;
 
-  // Record all iterations normally. Falsy iterations get truncated
-  // from the recorder so the timeline doesn't fill with polling
-  // noise; the LAST iteration's events stay, then get marked as
-  // children of the wait event so the UI can render them nested.
+  // Record all iterations normally, but keep only the newest one: a new
+  // attempt drops the events the previous attempt emitted, so the timeline
+  // never fills with polling noise. Whichever attempt is last when the loop
+  // ends — the winning one, or the final failed one — stays, and gets marked
+  // as a child of the wait event so the UI can render it nested.
+  //
+  // The failed attempt is kept deliberately. A poll that times out reports
+  // only "timed out after 120000ms (60 attempts)", which says nothing about
+  // WHY: an ingress answering an instant 404 for two minutes and a backend
+  // that never returns look identical in that message. The last attempt's
+  // events carry the status, the body and the duration, which is the whole
+  // difference between "the route was never programmed" and "the app hung".
   const beforePollIdx = recorderEventCount();
   let lastIterStartIdx = beforePollIdx;
-  let keptIterStartIdx = beforePollIdx;
 
   while (Date.now() - start < timeoutMs) {
     attempts += 1;
+    // Drop the *previous* attempt's events, not this one's — its events are
+    // the ones worth keeping until a newer attempt replaces them.
+    recorderTruncate(lastIterStartIdx);
     lastIterStartIdx = recorderEventCount();
     try {
       const v = await fn();
       if (v !== null && v !== undefined && v !== false) {
         value = v as T;
         success = true;
-        keptIterStartIdx = lastIterStartIdx;
         break;
       }
     } catch (err) {
       predicateError = err;
       break;
     }
-    // Failed iteration — drop the events it emitted.
-    recorderTruncate(lastIterStartIdx);
     if (Date.now() - start + intervalMs > timeoutMs) break;
     await new Promise((r) => setTimeout(r, intervalMs));
   }
 
-  if (!success) {
-    // Timeout or predicate error: drop every attempt's events. The
-    // wait event we emit below is the only trace.
-    recorderTruncate(beforePollIdx);
-  }
-
   const errMsg =
     predicateError !== undefined
       ? ((predicateError as Error)?.message ?? String(predicateError))
@@ -4166,11 +4277,11 @@ async function pollCall<T>(
     ...(errMsg !== undefined ? { error: errMsg } : {}),
   }, resv);
 
-  if (success && seq !== undefined) {
+  if (seq !== undefined) {
     // Group the kept iteration's events under the wait so the UI can
     // render them inside the wait card. The wait event itself is the
     // very last entry; markChildren skips it via the seq match.
-    recorderMarkChildren(keptIterStartIdx, seq);
+    recorderMarkChildren(lastIterStartIdx, seq);
   }
 
   if (predicateError !== undefined) throw predicateError;

package/src/index.ts

@@ -34,6 +34,21 @@ import type { OpTag, Provenanced, SpectestFetch, Wrapped } from "./inspect.js";
 // `unwrap(x)` free function. See the `.unwrap()` discipline section of `spectest docs`.
 export { field } from "./inspect.js";
 
+// Render annotations for fake helpers: a helper returns
+// `annotate(value, "email", { … })` when its value is an email, and the
+// fake step it records gains a nested `email` event — the same one the
+// built-in `email()` component records — so the step's panel can draw the
+// mail, tabbing to the raw JSON value. The kind picks the options' type, and the test still gets
+// the raw value, with the raw value's type — see `annotate.ts`.
+export { annotate } from "./annotate.js";
+export type {
+  Annotated,
+  AnnotationKind,
+  AnnotationOptions,
+  EmailAnnotation,
+} from "./annotate.js";
+import type { Annotated } from "./annotate.js";
+
 // Instrumented client primitives — drop-in replacements for Bun's native
 // clients that record each operation on the test event log and return their
 // results inspect-wrapped, so `expect(...)` on a result links back to the op
@@ -58,6 +73,8 @@ export type {
   FilterOptions,
   ClickOptions,
   BoundingBox,
+  FilePayload,
+  InputFiles,
 } from "./locator.js";
 import type { Locator } from "./locator.js";
 import {
@@ -312,6 +329,10 @@ export interface SpectestContext<
   /** Read a project file as UTF-8. Relative paths resolve against
    *  {@link projectRoot}; absolute paths are read as-is. */
   readProjectFile(path: string): Promise<string>;
+  /** Read a project file as bytes — a fixture to post, hash, or compare
+   *  against what the app under test received. Same path rules as
+   *  {@link readProjectFile}. */
+  readProjectFileBytes(path: string): Promise<Uint8Array>;
   /**
    * Run a command inside a service container. Pass an **array** for exact
    * argv with no shell (`["psql", "-f", "-"]`), or a **string** to run via
@@ -1627,6 +1648,10 @@ export interface FakeDefinition<
    * Every call is tracked in the test timeline: it records a `fake` step
    * and the return value is tagged so a later `expect(...)` on it nests
    * under that step in the UI (same provenance as `fetch`/db results).
+   * The step renders the return value as JSON; wrap it in {@link annotate}
+   * to add a richer view (an email, today) that the step's panel leads with,
+   * the JSON one tab away — the test still receives the raw value, unchanged
+   * and unchanged in type.
    *
    * Receives the fake's `state` plus a {@link FakeContext} `ctx`, so a
    * helper can provision/teardown runtime services just like the handler.
@@ -1697,12 +1722,20 @@ export type FakesMap = Record<string, FakeDefinition<any, any>>;
  * `components/k3s.ts`, extended to cover synchronous returns. */
 type WrappedHelpers<H> = {
   [K in keyof H]: H[K] extends (...args: infer A) => Promise<infer R>
-    ? (...args: A) => Promise<Wrapped<R>>
+    ? (...args: A) => Promise<Wrapped<Unannotated<R>>>
     : H[K] extends (...args: infer A) => infer R
-      ? (...args: A) => [R] extends [void] ? void : Wrapped<R>
+      ? (...args: A) => [R] extends [void] ? void : Wrapped<Unannotated<R>>
       : H[K];
 };
 
+/** A helper's return type as the *test* sees it. {@link annotate} boxes the
+ * value in an {@link Annotated} to pick how the step renders; the daemon
+ * opens that box at the helper boundary, so the annotation never reaches
+ * the caller — in the types either. Distributes over a union, so a helper
+ * that annotates only when it has something (`return m && annotate(m, "email")`)
+ * still reads as `T | undefined`. */
+type Unannotated<R> = R extends Annotated<infer U> ? U : R;
+
 /** Awaited return type of a fake's `helpers` factory (with each result
  * inspect-wrapped, see {@link WrappedHelpers}), or `{ state: S }` (the
  * default) when the user didn't ship one. */

package/src/locator.ts

@@ -22,9 +22,11 @@
 // author-facing call is exactly one recorded browser event (with its rrweb
 // drain), whatever playwright work it composes underneath.
 
+import { Buffer } from "node:buffer";
 import type { Page, Locator as PWLocator } from "playwright-core";
 import type { RecordableFields } from "./browser.js";
 import type { Wrapped } from "./inspect.js";
+import { resolveExistingProjectPath } from "./project-files.js";
 import { truncateUtf8 } from "./recorder.js";
 
 /** Default deadline for a locator action/read's target to become actionable.
@@ -79,6 +81,21 @@ export interface ClickOptions {
   modifiers?: Array<"Alt" | "Control" | "Meta" | "Shift">;
 }
 
+/** A file built in the test rather than read from the repo — the argument
+ *  shape playwright's `setInputFiles` takes, with `buffer` widened to a plain
+ *  `Uint8Array`/string and `mimeType` optional. */
+export interface FilePayload {
+  name: string;
+  /** Defaults to `application/octet-stream`. */
+  mimeType?: string;
+  /** Bytes, or text (encoded UTF-8). */
+  buffer: Uint8Array | string;
+}
+
+/** What `setInputFiles` accepts: repo-relative (or absolute) paths, built
+ *  files, or `[]` to clear the input. */
+export type InputFiles = string | string[] | FilePayload | FilePayload[];
+
 export interface TimeoutOption {
   timeout?: number;
 }
@@ -454,6 +471,34 @@ async function stampActionPoint(
   }
 }
 
+/** Fold a {@link InputFiles} argument into the one playwright takes: repo
+ *  paths resolved to their in-VM location (see project-files.ts), built files
+ *  given a default mime type and a real `Buffer`. The names come back too —
+ *  they are what the timeline step shows, and the bytes never go near it. */
+function lowerInputFiles(files: InputFiles): {
+  arg: string[] | { name: string; mimeType: string; buffer: Buffer }[];
+  names: string[];
+} {
+  const many = Array.isArray(files) ? files : [files];
+  // `[]` clears the input, and every() is true for it — so an empty call
+  // lands here and lowers to an empty path list, which is what clears.
+  if (many.every((f) => typeof f === "string")) {
+    const paths = (many as string[]).map((f) => resolveExistingProjectPath(f, "fixture"));
+    return { arg: paths, names: paths.map((p) => p.split("/").pop() ?? p) };
+  }
+  if (many.some((f) => typeof f === "string")) {
+    throw new Error(
+      "setInputFiles: pass either repo paths or built files — not both in one call",
+    );
+  }
+  const payloads = (many as FilePayload[]).map((f) => ({
+    name: f.name,
+    mimeType: f.mimeType ?? "application/octet-stream",
+    buffer: typeof f.buffer === "string" ? Buffer.from(f.buffer, "utf8") : Buffer.from(f.buffer),
+  }));
+  return { arg: payloads, names: payloads.map((f) => f.name) };
+}
+
 // ────────────────────────────────────────────────────────────────────────
 // The Locator interface
 // ────────────────────────────────────────────────────────────────────────
@@ -513,6 +558,25 @@ export interface Locator {
     values: string | string[] | { label?: string; value?: string; index?: number },
     opts?: TimeoutOption,
   ): Promise<Wrapped<string[]>>;
+  /**
+   * Give an `<input type="file">` its files — the upload primitive, since a
+   * browser refuses a script-set value on a file input. Targets the control a
+   * `<label>` points at, and does **not** require the input to be visible, so
+   * the hidden input behind a drop zone or a styled "Choose file" button is
+   * the thing to select.
+   *
+   * A string is a path in your repo, relative to `ctx.projectRoot` (absolute
+   * paths are taken as-is) — keep fixtures in `spectest/tests/fixtures/`, which
+   * is out of the environment cache key, so adding one still gives a warm
+   * start. Pass a {@link FilePayload} instead for a file the test builds, and
+   * `[]` to clear the input.
+   *
+   * ```ts
+   * await b.locator("#file").setInputFiles("spectest/tests/fixtures/invoice.pdf");
+   * await b.getByLabel("Avatar").setInputFiles({ name: "a.txt", buffer: "hi" });
+   * ```
+   */
+  setInputFiles(files: InputFiles, opts?: TimeoutOption): Promise<void>;
   hover(opts?: TimeoutOption): Promise<void>;
   focus(opts?: TimeoutOption): Promise<void>;
   blur(opts?: TimeoutOption): Promise<void>;
@@ -663,6 +727,12 @@ export function makeLocator(
       act("setChecked", {}, (l) => l.setChecked(checked, { timeout: opts?.timeout })),
     selectOption: (values, opts) =>
       read("selectOption", (l) => l.selectOption(values as never, { timeout: opts?.timeout })),
+    setInputFiles: (files, opts) => {
+      const { arg, names } = lowerInputFiles(files);
+      return act("setInputFiles", { files: names }, (l) =>
+        l.setInputFiles(arg, { timeout: opts?.timeout }),
+      );
+    },
     hover: (opts) => act("hover", {}, (l) => l.hover({ timeout: opts?.timeout })),
     focus: (opts) => act("focus", {}, (l) => l.focus({ timeout: opts?.timeout })),
     blur: (opts) => act("blur", {}, (l) => l.blur({ timeout: opts?.timeout })),

package/src/project-files.ts

@@ -0,0 +1,103 @@
+// Where a path in the user's repo lands inside the VM.
+//
+// The project exists in the guest TWICE, and the two copies are not refreshed
+// at the same time (see `env.rs`):
+//
+//   /workspace                    the whole repo. Written by a cold or delta
+//                                 start only — a warm start never re-uploads it.
+//   /opt/spectest/app/spectest    the user's `spectest/` directory. Re-uploaded
+//                                 on EVERY start, warm ones included.
+//
+// A warm start happens only when the warm-template hash matches, so /workspace
+// is correct for every file that is IN that hash. It can be behind for the two
+// kinds of file the hash excludes: `spectest/tests/**` (excluded so a test-only
+// edit keeps the fast start) and anything a project lists in
+// `spectest/.envignore`.
+//
+// Hence the rule below: a path under `spectest/` resolves against the app copy
+// first, because that copy is always current — this is what lets a fixture live
+// in `spectest/tests/fixtures/` and still be found after it was added. Any
+// other path resolves against /workspace, which the hash keeps current.
+//
+// The remaining hole is a file that `.envignore` excludes AND that sits outside
+// `spectest/`: /workspace holds whatever the cold start uploaded, so a later
+// edit is invisible. Nothing can repair those bytes at read time, so we refuse
+// to read them instead of returning stale content. The control plane writes the
+// exact path list it excluded (env.rs) into ENV_IGNORED_FILE.
+
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+/** The extracted repo — `ctx.projectRoot`. */
+export const WORKSPACE = process.env.SPECTEST_WORKSPACE ?? "/workspace";
+/** The app dir; the user's `spectest/` sits directly under it. */
+export const APP_DIR = process.env.SPECTEST_APP_DIR ?? "/opt/spectest/app";
+
+/** Paths (repo-relative) the warm-template hash skipped because of
+ *  `spectest/.envignore`. Written by the control plane at env start; absent
+ *  when the project ships no `.envignore`. */
+const ENV_IGNORED_FILE = "/run/spectest-env-ignored.json";
+
+let _envIgnored: Set<string> | undefined;
+function envIgnored(): Set<string> {
+  if (_envIgnored) return _envIgnored;
+  let paths: string[] = [];
+  try {
+    const raw = JSON.parse(readFileSync(ENV_IGNORED_FILE, "utf8")) as { paths?: string[] };
+    paths = raw.paths ?? [];
+  } catch {
+    /* No file (no .envignore, or an older env) — nothing to refuse. */
+  }
+  _envIgnored = new Set(paths);
+  return _envIgnored;
+}
+
+/** Repo-relative form of `p`: no leading `./`, POSIX separators. */
+function relative(p: string): string {
+  return path.normalize(p).replace(/^\.\//, "").replace(/^\/+/, "");
+}
+
+/**
+ * Absolute in-VM path for a path in the user's repo. Absolute input is
+ * returned as-is. A relative path resolves against the project, preferring the
+ * copy that a warm start refreshes (see the header).
+ *
+ * A file that is missing everywhere resolves to its /workspace candidate, so
+ * the caller's own `fs` error names a real path — `readProjectFile` keeps
+ * reporting ENOENT the way it always has.
+ */
+export function resolveProjectPath(p: string): string {
+  if (path.isAbsolute(p)) return p;
+  const rel = relative(p);
+  if (rel.startsWith("spectest/")) {
+    const app = path.join(APP_DIR, rel);
+    if (existsSync(app)) return app;
+  }
+  if (envIgnored().has(rel)) {
+    throw new Error(
+      `project file "${p}" is excluded by spectest/.envignore, so the copy in the VM ` +
+        `is whatever a cold start uploaded and can be out of date. Move it under ` +
+        `spectest/tests/ (still cache-free, and always re-uploaded), or drop the pattern.`,
+    );
+  }
+  return path.join(WORKSPACE, rel);
+}
+
+/** {@link resolveProjectPath}, but a missing file is an error that names every
+ *  place we looked. For inputs a user hands us by name — a fixture — where an
+ *  ENOENT on one guessed path reads as a spectest bug rather than a typo. */
+export function resolveExistingProjectPath(p: string, what = "file"): string {
+  const resolved = resolveProjectPath(p);
+  if (existsSync(resolved)) return resolved;
+  const rel = relative(p);
+  const looked = path.isAbsolute(p)
+    ? [p]
+    : rel.startsWith("spectest/")
+      ? [path.join(APP_DIR, rel), path.join(WORKSPACE, rel)]
+      : [path.join(WORKSPACE, rel)];
+  throw new Error(
+    `${what} "${p}" is not in the VM (looked in ${looked.join(", ")}). Paths are ` +
+      `relative to your repo root. Check that the file is committed and not ` +
+      `excluded by .gitignore/.spectestignore.`,
+  );
+}