@specific.dev/spectest 0.86.2 → 0.88.0

package/src/components/supabase-functions-reach.test.ts

@@ -0,0 +1,90 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { excludeAllBut, functionsReach, importMapLocalTargets, importSpecifiers } from "./supabase-functions-reach.js";
+
+let root: string;
+
+function file(rel: string, text: string): void {
+  mkdirSync(join(root, rel, ".."), { recursive: true });
+  writeFileSync(join(root, rel), text);
+}
+
+beforeAll(() => {
+  root = mkdtempSync(join(tmpdir(), "sb-fn-reach-"));
+  file("supabase/functions/hello/index.ts", 'import { greet } from "../../../packages/shared/src/greet.ts";\nimport "npm:zod";\nDeno.serve(() => new Response(greet()));\n');
+  file("supabase/functions/bye/index.ts", 'import { db } from "@db/client.ts";\nexport default 1;\n');
+  file("supabase/functions/deno.json", JSON.stringify({ imports: { "@db/": "../../lib/db/", "zod": "npm:zod" } }));
+  file("packages/shared/src/greet.ts", 'import { fmt } from "./fmt.ts";\nimport { util } from "../../util/mod.ts";\nexport const greet = () => fmt(util());\n');
+  file("packages/shared/src/fmt.ts", "export const fmt = (s: string) => s;\n");
+  file("packages/util/mod.ts", "export const util = () => 'x';\n");
+  file("lib/db/client.ts", "export const db = 1;\n");
+  file("docs/guide.md", "# not code\n");
+  file("site/app/page.tsx", 'import x from "../../packages/shared/src/greet.ts";\n');
+});
+
+afterAll(() => rmSync(root, { recursive: true, force: true }));
+
+describe("functionsReach", () => {
+  test("follows relative imports and local import-map entries transitively, into directories", () => {
+    expect(functionsReach(root, "supabase/functions")).toEqual(["lib/db", "packages/shared/src", "packages/util", "supabase/functions"]);
+  });
+  test("a self-contained functions directory is the whole answer; a missing one is nothing", () => {
+    file("alone/functions/f/index.ts", 'import "https://deno.land/std/http/server.ts";\nimport("./helper.ts");\n');
+    expect(functionsReach(root, "alone/functions")).toEqual(["alone/functions"]);
+    expect(functionsReach(root, "nowhere/functions")).toEqual([]);
+  });
+  test("an import that leaves the project is ignored", () => {
+    file("escape/functions/f/index.ts", 'import "../../../../../../etc/passwd";\n');
+    expect(functionsReach(root, "escape/functions")).toEqual(["escape/functions"]);
+  });
+  test("the exclude list drops everything but the answer", () => {
+    expect(excludeAllBut(["lib/db", "supabase/functions"])).toEqual([
+      "**",
+      "!lib/db",
+      "!lib/db/**",
+      "!supabase/functions",
+      "!supabase/functions/**",
+      "**/node_modules/**",
+      "**/.git/**",
+      "**/.spectest/**",
+      "**/__pycache__/**",
+      "**/.venv/**",
+    ]);
+    expect(excludeAllBut(["."])).toEqual([]);
+  });
+});
+
+describe("parsers", () => {
+  test("import specifiers of every shape", () => {
+    const t = 'import a from "./a.ts";\nexport * from "../b.ts";\nimport "./side.ts";\nconst m = await import("./dyn.ts");\nimport type { T } from "npm:x";\n';
+    expect(importSpecifiers(t)).toEqual(["./a.ts", "../b.ts", "./side.ts", "./dyn.ts", "npm:x"]);
+  });
+  test("import map local targets", () => {
+    expect(importMapLocalTargets('{"imports":{"@a/":"../../a/","b":"npm:b","c":"/c/mod.ts"}}')).toEqual(["../../a/", "/c/mod.ts"]);
+    expect(importMapLocalTargets("not json")).toEqual([]);
+  });
+});
+
+describe("supabase() wiring", () => {
+  test("the functions image context is the module graph, and the root mount is reach-exempt", async () => {
+    const prev = process.env.SPECTEST_WORKSPACE;
+    process.env.SPECTEST_WORKSPACE = root;
+    try {
+      const { supabase } = await import("./supabase.js");
+      const stack = supabase({ dir: "supabase" });
+      const parts = stack.group.services({ name: "sb", key: (part: string) => (part === "gateway" ? "sb" : `sb-${part}`) });
+      const fn = parts.functions as { image: { context?: string; exclude?: readonly string[] }; volumes?: readonly { source?: string; reachExempt?: boolean }[] };
+      expect(fn.image.context).toBe(".");
+      expect(fn.image.exclude?.slice(0, 9)).toEqual(["**", "!lib/db", "!lib/db/**", "!packages/shared/src", "!packages/shared/src/**", "!packages/util", "!packages/util/**", "!supabase/functions", "!supabase/functions/**"]);
+      expect(fn.image.exclude?.at(-1)).toBe("**/.venv/**");
+      expect(fn.volumes?.[0]).toMatchObject({ source: root, reachExempt: true });
+      expect((parts.db as { inputs?: readonly string[] }).inputs).toEqual(["supabase"]);
+    } finally {
+      if (prev === undefined) delete process.env.SPECTEST_WORKSPACE;
+      else process.env.SPECTEST_WORKSPACE = prev;
+    }
+  });
+});

package/src/components/supabase-functions-reach.ts

@@ -0,0 +1,153 @@
+// What the edge functions can load from the project — the pure part.
+//
+// The edge runtime serves each function from the project root, mounted
+// whole so that a monorepo function's `../../packages/shared/mod.ts`
+// resolves where it sits. Whole is right for the runtime and wrong for
+// the reach: with the root in a build context and a volume, every file of
+// the project could "reach" the functions, and a change to `docs/` could
+// never skip a run. So the component works out the **module graph** the
+// functions can load, statically, and hands the build context and the
+// reach exactly that: the functions directory, and every directory a
+// relative import or a local import-map entry leads to, followed
+// transitively. Directories rather than files, so a sibling module a
+// dynamic `import()` picks at run time comes along.
+//
+// What it cannot see: a computed specifier that leaves the directories
+// found (`import(\`../../${x}/mod.ts\`)`), and a `Deno.readTextFile` of a
+// path outside them. Both are rare in a function, and both are the same
+// class of hole as a test reading the workspace through `node:fs`. A tree
+// too large to walk within the budget is answered with the whole project,
+// the safe side.
+
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+/** Files the walk parses for imports. */
+const SOURCE_EXT = /\.(?:[mc]?[jt]sx?)$/;
+/** Names never walked into. */
+const SKIP = new Set(["node_modules", ".git", ".spectest", "dist", "build", ".next"]);
+/** The walk gives up past this many files and answers with the root. */
+const FILE_BUDGET = 20_000;
+
+const IMPORT_RE =
+  /\b(?:import|export)\b[^;'"`]*?\bfrom\s*['"]([^'"]+)['"]|\bimport\s*['"]([^'"]+)['"]|\bimport\(\s*['"]([^'"]+)['"]\s*\)/g;
+
+/** Specifiers a source text imports, as written. */
+export function importSpecifiers(text: string): string[] {
+  const out: string[] = [];
+  for (const m of text.matchAll(IMPORT_RE)) out.push(m[1] ?? m[2] ?? m[3] ?? "");
+  return out.filter((s) => s.length > 0);
+}
+
+/** Local targets an import map (`deno.json` `imports`, `import_map.json`)
+ *  names, as written: relative values, and root-relative `/…` ones. */
+export function importMapLocalTargets(text: string): string[] {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return [];
+  }
+  const imports = (parsed as { imports?: unknown })?.imports;
+  if (typeof imports !== "object" || imports === null) return [];
+  return Object.values(imports as Record<string, unknown>).filter(
+    (v): v is string => typeof v === "string" && (v.startsWith("./") || v.startsWith("../") || v.startsWith("/")),
+  );
+}
+
+function toPosix(p: string): string {
+  return sep === "/" ? p : p.split(sep).join("/");
+}
+
+/**
+ * The directories, project-relative and sorted, that the functions under
+ * `fnRelPath` can load modules from: `fnRelPath` itself, and every
+ * directory a relative import or a local import-map entry leads to,
+ * transitively. `["."]` when the walk runs out of budget. A directory
+ * nested under another in the answer is dropped.
+ */
+export function functionsReach(root: string, fnRelPath: string): string[] {
+  const rootAbs = resolve(root);
+  const dirs = new Set<string>();
+  const queue: string[] = [resolve(rootAbs, fnRelPath)];
+  let budget = FILE_BUDGET;
+
+  const inRoot = (p: string): boolean => p === rootAbs || p.startsWith(rootAbs + sep);
+  const enqueue = (target: string): void => {
+    if (!inRoot(target) || !existsSync(target)) return;
+    let st;
+    try {
+      st = statSync(target);
+    } catch {
+      return;
+    }
+    const dir = st.isDirectory() ? target : dirname(target);
+    if (![...dirs].some((d) => dir === d || dir.startsWith(d + sep))) queue.push(dir);
+  };
+  const follow = (fromDir: string, spec: string): void => {
+    if (spec.startsWith("./") || spec.startsWith("../")) enqueue(resolve(fromDir, spec));
+    else if (spec.startsWith("/")) enqueue(resolve(rootAbs, spec.slice(1)));
+  };
+
+  while (queue.length > 0) {
+    const dir = queue.shift()!;
+    if ([...dirs].some((d) => dir === d || dir.startsWith(d + sep))) continue;
+    if (!existsSync(dir)) continue;
+    dirs.add(dir);
+    // Every file below it, parsed for what it imports.
+    const stack: string[] = [dir];
+    while (stack.length > 0) {
+      const d = stack.pop()!;
+      let entries;
+      try {
+        entries = readdirSync(d, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const e of entries) {
+        const p = join(d, e.name);
+        if (e.isDirectory()) {
+          if (!SKIP.has(e.name)) stack.push(p);
+          continue;
+        }
+        if (!e.isFile()) continue;
+        if (--budget < 0) return ["."];
+        if (e.name === "deno.json" || e.name === "import_map.json") {
+          for (const t of importMapLocalTargets(safeRead(p))) follow(d, t.endsWith("/") ? t.slice(0, -1) : t);
+          continue;
+        }
+        if (!SOURCE_EXT.test(e.name)) continue;
+        for (const spec of importSpecifiers(safeRead(p))) follow(d, spec);
+      }
+    }
+  }
+
+  // Minimal, project-relative, sorted.
+  const rel = [...dirs].map((d) => (d === rootAbs ? "." : toPosix(relative(rootAbs, d))));
+  const minimal = rel.filter((d) => !rel.some((o) => o !== d && (o === "." || d.startsWith(o + "/"))));
+  return [...new Set(minimal)].sort();
+}
+
+function safeRead(p: string): string {
+  try {
+    return readFileSync(p, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+/** The `exclude` list that narrows a root build context to `dirs`: drop
+ *  everything, then re-include each directory and its subtree, then drop
+ *  again what no context should carry (a re-included `packages/shared`
+ *  would otherwise bring its `node_modules` along). */
+export function excludeAllBut(dirs: readonly string[]): string[] {
+  if (dirs.includes(".")) return [];
+  return ["**", ...dirs.flatMap((d) => [`!${d}`, `!${d}/**`]), ...REEXCLUDE];
+}
+
+/** Re-excluded after the re-includes: the names the default ignore drops. */
+const REEXCLUDE = ["**/node_modules/**", "**/.git/**", "**/.spectest/**", "**/__pycache__/**", "**/.venv/**"];
+
+// Keep `isAbsolute` referenced for callers that pass absolute fnRelPath by
+// mistake: the walk resolves it against the root either way.
+void isAbsolute;

package/src/components/supabase.ts

@@ -51,6 +51,7 @@
 
 import { createHmac } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
+import { excludeAllBut, functionsReach } from "./supabase-functions-reach.js";
 import { readdir, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
 
@@ -166,6 +167,9 @@ function providerCredentials(
  * cache rides into the image as a layer — so at run time the worker resolves
  * those URLs locally and never reaches for the network.
  *
+ * The context is the module graph the functions can load (the functions
+ * directory and what its imports lead to, `functionsReach`), copied whole
+ * so a monorepo function's `../../packages/…` resolves at bundle time too.
  * One synthetic entrypoint imports every function, so the whole set is one
  * graph rather than one per function. Bundling is best-effort: a function that
  * fails to bundle (a type error, an import that only resolves at run time)
@@ -175,13 +179,13 @@ function providerCredentials(
 function functionsDockerfile(fnRelPath: string): string {
   return `FROM ${IMAGES.functions}
 ENV DENO_DIR=${DENO_DIR}
-COPY ${fnRelPath} /warm/functions
+COPY . /warm/repo
 RUN set -eu; \
     : > /warm/all.ts; \
-    for d in /warm/functions/*/; do \
+    for d in /warm/repo/${fnRelPath}/*/; do \
       [ -f "$d/index.ts" ] || continue; \
       n=$(basename "$d"); \
-      printf 'import "./functions/%s/index.ts";\\n' "$n" >> /warm/all.ts; \
+      printf 'import "./repo/${fnRelPath}/%s/index.ts";\\n' "$n" >> /warm/all.ts; \
     done; \
     edge-runtime bundle --entrypoint /warm/all.ts --output /tmp/warm.eszip --quiet || true; \
     rm -rf /tmp/warm.eszip /warm
@@ -1684,6 +1688,10 @@ export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
         ? `${REPO_MOUNT}/${fnDir.slice(root.length + 1)}`
         : `${REPO_MOUNT}/supabase/functions`;
   const migrationsPath = inDir("migrations");
+  // The directories the functions can load modules from: the functions
+  // directory and what its imports lead to (`supabase-functions-reach.ts`).
+  // The build context and the reach are narrowed to exactly these.
+  const fnReachDirs = withFunctions ? functionsReach(root, fnRelPath) : [];
 
   // ── config file (config.toml / config.json) ───────────────────────────
   // The CLI's own project config, mapped onto the stack. Read at build time:
@@ -1890,8 +1898,20 @@ export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
       const parts: ServicesMap = {};
 
       // ── db ──────────────────────────────────────────────────────────
+      // What the stack reads from the project: the Supabase folder
+      // (config.toml, migrations, seed, functions) and the mail templates,
+      // which may sit anywhere in the repo. Declared as inputs so a change
+      // to any of them is never taken as one that can affect no test; the
+      // migrations volume carries the folder too, but only when there is
+      // a migrations directory, and a config-only project must count as
+      // well.
+      const inputs: string[] = [
+        ...(opts.dir !== undefined && !opts.dir.startsWith("/") ? [opts.dir] : []),
+        ...templateBodies.map(([, spec]) => spec.path).filter((t) => !t.startsWith("/")),
+      ];
       const dbDef: ServiceDefinition = {
         image: { type: "registry", reference: opts.db?.image ?? IMAGES.db },
+        ...(inputs.length > 0 ? { inputs } : {}),
         // `args` (not `command`): keep the image's docker-entrypoint.sh so it
         // runs initdb + its baked init-scripts before starting.
         args: [
@@ -2211,6 +2231,12 @@ export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
           image: {
             type: "dockerfile",
             content: functionsDockerfile(fnRelPath),
+            // The root, narrowed to the module graph: only the functions
+            // directory and what its imports lead to enter the context, so
+            // a change anywhere else neither uploads nor counts as reaching
+            // the functions.
+            context: ".",
+            exclude: excludeAllBut(fnReachDirs),
           },
           // The **project root**, mounted with the functions directory in its
           // real position underneath. Mounting only `supabase/functions`
@@ -2219,8 +2245,10 @@ export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
           // (`../../../../packages/…`), and that only resolves if the
           // directory sits where it sits in the repo. Read-only: the runtime
           // only reads sources, and a function writing into its own directory
-          // would be writing into the user's checkout.
-          volumes: [{ source: projectRootPath(), target: REPO_MOUNT, readOnly: true }],
+          // would be writing into the user's checkout. For the reach the
+          // mount is exempt: what the functions can load is the module graph
+          // above, which the build context already states.
+          volumes: [{ source: projectRootPath(), target: REPO_MOUNT, readOnly: true, reachExempt: true }],
           // Our router (see FUNCTIONS_MAIN_TS) sits outside that mount, so
           // the project never has to carry a `main/` function of ours.
           files: [{ path: "/home/deno/main/index.ts", content: FUNCTIONS_MAIN_TS }],

package/src/daemon.ts

@@ -48,6 +48,7 @@ import {
   walkProjectFiles,
   ENVIRONMENT_SERVICE,
   REACH_REPORT,
+  READS_REPORT,
   type CoverageBundleRef,
   type CoverageReport,
   type ServiceCoverageCapture,
@@ -66,8 +67,9 @@ import {
   type CoverageInventoryContext,
 } from "./coverage.js";
 import { serviceForHost as hostToService } from "./harness/browser-coverage.js";
-import { acquirePersistentBrowser, mobileKey } from "./browser.js";
+import { acquirePersistentBrowser, acquirePersistentDesktop, mobileKey } from "./browser.js";
 import { isMobileApp, openPersistentMobile } from "./mobile.js";
+import { isDesktopApp, type Desktop, type DesktopApp, type DesktopOptions, type DesktopChrome } from "./desktop.js";
 // Pure ingress hostname matching, ported out of this file (see
 // harness/hostmatch.ts). Keeping ONE implementation is the point: the
 // exact-then-longest-suffix rule and the one-label certificate rule are
@@ -97,11 +99,11 @@ import {
   sanitizeSegment,
 } from "./harness/volume-paths.js";
 import { pollUntilReady } from "./harness/ready-poll.js";
-import { runWrapperRules } from "./harness/wrapper-rules.js";
+import { fsUsageDiagnostics, runWrapperRules } from "./harness/wrapper-rules.js";
 import type { WrapperDiagnostic } from "./harness/wrapper-rules.js";
 import { cpus, tmpdir } from "node:os";
 import { APP_DIR, WORKSPACE, resolveExistingProjectPath, resolveProjectPath, takeProjectReads } from "./project-files.js";
-import { projectReach, renderReach, renderReadsLcov, type ReachSource } from "./harness/reach.js";
+import { compactReach, projectReach, renderReachRules, renderReadsLcov, type ReachRules, type ReachSource } from "./harness/reach.js";
 import { installFetchWrapper, isTransportError } from "./harness/fetch.js";
 import {
   bindInstrumentationScope,
@@ -4237,7 +4239,7 @@ async function writeCoverageInventory(svc: NamedService): Promise<string | undef
  * bring-up capture. The resolution's own path lookups are bookkeeping,
  * not reads: they are taken out of the read set again afterwards.
  */
-async function computeProjectReach(all: NamedService[]): Promise<string[]> {
+async function computeProjectReach(all: NamedService[]): Promise<ReachRules> {
   const before = takeProjectReads();
   try {
     return await computeProjectReachInner(all);
@@ -4248,12 +4250,14 @@ async function computeProjectReach(all: NamedService[]): Promise<string[]> {
   }
 }
 
-async function computeProjectReachInner(all: NamedService[]): Promise<string[]> {
+async function computeProjectReachInner(all: NamedService[]): Promise<ReachRules> {
   const files = await walkProjectFiles(WORKSPACE, [".git"]);
   const sources: ReachSource[] = [];
   for (const svc of all) {
     const src: ReachSource = {
-      volumeSources: (svc.volumes ?? []).flatMap((v) => (v.source ? [v.source] : [])),
+      service: svc.name,
+      volumeSources: (svc.volumes ?? []).flatMap((v) => (v.source && !v.reachExempt ? [v.source] : [])),
+      ...(svc.inputs && svc.inputs.length > 0 ? { inputs: [...svc.inputs] } : {}),
     };
     if (svc.image.type === "dockerfile") {
       try {
@@ -4270,29 +4274,35 @@ async function computeProjectReachInner(all: NamedService[]): Promise<string[]>
     }
     sources.push(src);
   }
-  return projectReach(files, sources);
+  const reach = projectReach(files, sources);
+  return { version: 1, sources, prefixes: compactReach(files, reach) };
 }
 
 /**
  * The synthetic `__environment__` capture: what the environment itself
- * knows — the project's reach (bring-up only) and the project files the
- * harness read through the SDK since the previous capture, as whole
- * lcov records. Present whenever some service opted in, so the two ride
- * the same bundle as the services' reports.
+ * knows — the project's reach as rules (bring-up only) and the project
+ * files the harness read through the SDK since the previous capture, as
+ * whole lcov records. Present on every capture of every project, coverage
+ * adapters or not: the reach is a property of the environment config,
+ * and it is what lets the control plane tell that a change to `site/**`
+ * can affect no test at all. When services opted in, the two ride the
+ * same bundle as their reports.
  */
 async function captureEnvironmentCoverage(all: NamedService[], baseline: boolean): Promise<ServiceCoverageCapture> {
   const reports: CoverageReport[] = [];
   if (baseline) {
     try {
-      const reach = await computeProjectReach(all);
-      reports.push({ name: REACH_REPORT, content: renderReach(reach) });
-      console.log(`[coverage] project reach: ${reach.length} file(s) some build or volume can carry`);
+      const rules = await computeProjectReach(all);
+      reports.push({ name: REACH_REPORT, content: renderReachRules(rules) });
+      console.log(
+        `[coverage] project reach: ${rules.sources.length} source(s), ${rules.prefixes.length} prefix(es) some build or volume can carry`,
+      );
     } catch (err) {
       console.warn(`[coverage] project reach not computed: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const reads = takeProjectReads();
-  reports.push({ name: "reads.lcov", content: renderReadsLcov(reads) });
+  reports.push({ name: READS_REPORT, content: renderReadsLcov(reads) });
   return { service: ENVIRONMENT_SERVICE, reports };
 }
 
@@ -4304,7 +4314,8 @@ async function captureServiceCoverage(baseline = false): Promise<ServiceCoverage
   for (const [name, s] of RUNTIME_SERVICES) byName.set(name, s);
   const all = [...byName.values()];
   const services = all.filter((s) => s.coverage !== undefined);
-  if (services.length === 0) return [];
+  // The environment's own capture is unconditional (see above); the
+  // services' come from the ones that opted in, none included.
   const environment = captureEnvironmentCoverage(all, baseline);
   const captures = await Promise.all(
     services.map(async (svc): Promise<ServiceCoverageCapture> => {
@@ -4343,10 +4354,11 @@ interface BrowserSessionRecord {
   openedAtMs: number;
   closedAtMs?: number;
   initialUrl?: string;
-  /** Replay frame: `"browser"` (desktop window, default) or `"mobile"`
-   * (phone bezel). Drives the dashboard's chrome; the rrweb events are
+  /** Replay frame: `"browser"` (default), `"mobile"` (phone bezel), or
+   * `"desktop"` (native app window). Drives the dashboard's chrome; the rrweb events are
    * identical either way. */
-  frame?: "browser" | "mobile";
+  frame?: "browser" | "mobile" | "desktop";
+  desktopChrome?: DesktopChrome;
   /** Safe-area insets that were CDP-emulated during capture (mobile
    * sessions on a Chromium that supports the override). The dashboard
    * substitutes these for `env(safe-area-inset-*)` in the replayed CSS —
@@ -4454,7 +4466,7 @@ function browserArgs(
 function newBrowserSession(
   testStart: number,
   idScope: string,
-  frame: "browser" | "mobile" = "browser",
+  frame: "browser" | "mobile" | "desktop" = "browser",
   artifacts?: ReturnType<typeof newArtifactCollector>,
   name = "",
 ): {
@@ -4477,6 +4489,7 @@ function newBrowserSession(
     record,
     recorder: {
       sessionId: record.sessionId,
+      frame,
       ...(name ? { sessionName: name } : {}),
       recordStep(step) {
         if (closed) return;
@@ -4498,6 +4511,37 @@ function newBrowserSession(
   };
 }
 
+/** Same desktop recording path for test runs and interactive evals. */
+function desktopOpener(
+  start: number,
+  scope: string,
+  sessions: Array<ReturnType<typeof newBrowserSession>>,
+  detaches: Array<() => Promise<void>>,
+  artifacts?: ReturnType<typeof newArtifactCollector>,
+) {
+  const memo = new Map<string, Desktop>();
+  return async (app: DesktopApp, options: DesktopOptions = {}): Promise<Desktop> => {
+    if (!isDesktopApp(app)) throw new Error("ctx.desktop(app): pass ctx.svc.app from an electron() service");
+    const window = options.window ?? 0;
+    const key = JSON.stringify([app.endpoint, window]);
+    const existing = memo.get(key);
+    if (existing) return existing;
+    const session = newBrowserSession(start, scope, "desktop", artifacts, window === 0 ? app.name : `${app.name} · window ${window + 1}`);
+    const { browser, detach, desktopChrome } = await acquirePersistentDesktop(app.endpoint, window, session.recorder);
+    session.record.desktopChrome = desktopChrome;
+    session.record.initialUrl = browser.url();
+    sessions.push(session);
+    detaches.push(async () => { await detach(); session.markClosed(); });
+    const close = browser.close.bind(browser);
+    browser.close = async () => {
+      await close();
+      if (memo.get(key) === browser) memo.delete(key);
+    };
+    memo.set(key, browser);
+    return browser;
+  };
+}
+
 /** Per-Terminal asciicast session shipped to the control plane. */
 interface TerminalSessionRecord {
   sessionId: string;
@@ -5590,6 +5634,7 @@ async function runOne(testCase: TestCase<unknown>): Promise<RunResult> {
     openTerminal: recordedOpenTerminal,
     browser: trackedOpenBrowser,
     mobile: trackedOpenMobile,
+    desktop: desktopOpener(start, testCase.id, sessions, browserDetaches),
     mcp: openMcp,
     testName: testCase.name,
     parent,
@@ -6145,6 +6190,7 @@ async function evalCode(
     openTerminal: evalOpenTerminal,
     browser: trackedOpenBrowser,
     mobile: trackedOpenMobile,
+    desktop: desktopOpener(start, "eval", sessions, browserDetaches, artifactCollector),
     mcp: openMcp,
     testName: "eval",
     parent: undefined,
@@ -6415,7 +6461,7 @@ async function runTypecheck(): Promise<TypecheckReport> {
     return { status: "failed", errors: [], totalErrors: 0, durationMs, detail: "typecheck timed out" };
   }
   const { errors, total, suppressed } = parseTscOutput(res.stdout + res.stderr);
-  const wrapper = await runWrapperRulesReport(config);
+  const wrapper = [...(await runWrapperRulesReport(config)), ...(await rawFsReport())];
   const strip = ({ file, line, column, code, message }: WrapperDiagnostic): TypecheckError => ({
     file,
     line,
@@ -6453,6 +6499,29 @@ async function runTypecheck(): Promise<TypecheckReport> {
   };
 }
 
+/**
+ * The raw-fs rule (`SPECTEST2003`, advisory) over the test tree: a test
+ * that opens a project file through `node:fs` hides a dependence from the
+ * subset selector. Textual, so it needs no compiler; best-effort.
+ */
+async function rawFsReport(): Promise<WrapperDiagnostic[]> {
+  const root = path.join(APP_DIR, "tests");
+  if (!existsSync(root)) return [];
+  try {
+    const files = await walkProjectFiles(root, ["node_modules"]);
+    const out: WrapperDiagnostic[] = [];
+    for (const rel of files) {
+      if (!/\.(ts|tsx|js|jsx|mts|cts)$/.test(rel)) continue;
+      const text = await fs.readFile(path.join(root, rel), "utf8");
+      out.push(...fsUsageDiagnostics(path.join("tests", rel), text));
+    }
+    return out;
+  } catch (err) {
+    console.warn(`[typecheck] raw fs rule threw: ${(err as Error)?.message ?? err}`);
+    return [];
+  }
+}
+
 /**
  * The blocking rules, run against the BAKED compiler whatever the project
  * pins. Best-effort in every direction: an install that predates the API, a

package/src/desktop-recorder.test.ts

@@ -0,0 +1,55 @@
+import { expect, test } from 'bun:test';
+import { runInNewContext } from 'node:vm';
+import { DESKTOP_INPUT_SYNC_SCRIPT } from './desktop-recorder.js';
+
+function recorder(type = 'textarea', blocked = false) {
+  const element = { type, value: 'draft', checked: false, hasAttribute: (_name: string) => false, closest: () => blocked ? {} : null };
+  const window: any = { __spectestRec: { mirror: { getId: () => 7 } }, __spectestRrwebEvents: [] };
+  runInNewContext(DESKTOP_INPUT_SYNC_SCRIPT, { window, document: { querySelectorAll: () => [element] } });
+  return { element, window, events: window.__spectestRrwebEvents as any[] };
+}
+
+test('late attachment captures a controlled input clearing without a DOM input event', () => {
+  const { element, window, events } = recorder();
+  expect(events).toHaveLength(0);
+  element.value = '';
+  window.__spectestSyncInputs(123);
+  expect(JSON.parse(JSON.stringify(events))).toEqual([
+    { type: 3, data: { source: 5, id: 7, text: '', isChecked: false }, timestamp: 123 },
+  ]);
+  window.__spectestSyncInputs(124);
+  expect(events).toHaveLength(1);
+});
+
+test('rrweb input events need no duplicate correction; a snapshot does not hide later changes', () => {
+  const { element, window, events } = recorder();
+  element.value = 'typed';
+  events.push({ type: 3, data: { source: 5, id: 7, text: 'typed', isChecked: false } });
+  window.__spectestSyncInputs();
+  expect(events).toHaveLength(1);
+  events.length = 0;
+  events.push({ type: 2, data: {} });
+  element.value = '';
+  window.__spectestSyncInputs();
+  expect(events).toHaveLength(2);
+  expect(events[1].data.text).toBe('');
+});
+
+test('correction respects password masking, blocked controls and file inputs', () => {
+  const password = recorder('password');
+  password.element.value = 'secret-value';
+  password.window.__spectestSyncInputs();
+  expect(password.events[0].data.text).toBe('************');
+  expect(JSON.stringify(password.events)).not.toContain('secret-value');
+  const revealed = recorder('text');
+  revealed.element.hasAttribute = name => name === 'data-rr-is-password';
+  revealed.element.value = 'revealed-secret';
+  revealed.window.__spectestSyncInputs();
+  expect(revealed.events[0].data.text).toBe('***************');
+  expect(JSON.stringify(revealed.events)).not.toContain('revealed-secret');
+  for (const fixture of [recorder('textarea', true), recorder('file')]) {
+    fixture.element.value = 'private';
+    fixture.window.__spectestSyncInputs();
+    expect(fixture.events).toHaveLength(0);
+  }
+});

package/src/desktop-recorder.ts

@@ -0,0 +1,30 @@
+// A late recorder cannot interpose on setters React cached during mounting.
+// Reconcile controls at action boundaries, without changing the app's DOM or
+// descriptors. Normal rrweb Input events win; synthesize only missing changes.
+export const DESKTOP_INPUT_SYNC_SCRIPT = String.raw`(() => {
+  if (window.__spectestSyncInputs) return;
+  const known = new WeakMap();
+  window.__spectestSyncInputs = (timestamp = Date.now()) => {
+    const rec = window.__spectestRec;
+    const events = window.__spectestRrwebEvents;
+    if (!rec?.mirror || !events) return;
+    const inputs = new Map();
+    for (const event of events) {
+      if (event.type === 3 && event.data?.source === 5) inputs.set(event.data.id, event.data);
+    }
+    for (const element of document.querySelectorAll('input, textarea, select')) {
+      const type = element.hasAttribute('data-rr-is-password') ? 'password' : element.type?.toLowerCase();
+      if (type === 'file' || element.closest('.rr-block, .rr-ignore')) continue;
+      const id = rec.mirror.getId(element);
+      if (!(id > 0)) continue;
+      const text = type === 'password' ? '*'.repeat(element.value.length) : element.value;
+      const isChecked = (type === 'checkbox' || type === 'radio') ? element.checked : false;
+      const current = { text, isChecked };
+      const previous = inputs.get(id) ?? known.get(element);
+      known.set(element, current);
+      if (!previous || (previous.text === text && previous.isChecked === isChecked)) continue;
+      events.push({ type: 3, data: { source: 5, id, text, isChecked }, timestamp });
+    }
+  };
+  window.__spectestSyncInputs();
+})();`;