@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/__tests__/file-url-path-guard.test.ts

@@ -0,0 +1,83 @@
+/**
+ * Guard against deriving a filesystem path from a `file:` URL's `.pathname`.
+ *
+ * `URL.pathname` is percent-encoded, so any path segment containing a space
+ * survives as `%20` and every downstream `existsSync` / spawn against it
+ * fails. This is not theoretical: macOS desktop installs live under
+ * `~/Library/Application Support/…`, so the encoded form broke every
+ * background worker spawn on that platform. `fileURLToPath()` decodes.
+ *
+ * Two shapes are checked:
+ *   1. `.pathname` read off a URL built from `import.meta.url`.
+ *   2. `.pathname` passed inside a `cmd: [...]` spawn array, the sink that
+ *      turns an encoded path into a "Module not found" at runtime.
+ */
+
+import { readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+const SRC_DIR = join(import.meta.dir, "..");
+
+/** This guard's own file, which necessarily contains the forbidden patterns. */
+const SELF = "__tests__/file-url-path-guard.test.ts";
+
+/** `.pathname` read off a URL derived from `import.meta.url`. */
+const IMPORT_META_URL_PATHNAME =
+  /import\.meta\.url[\s\S]{0,80}?\)\s*\.pathname/;
+
+/** A `cmd: [...]` spawn array (bounded so it can't run away over a file). */
+const SPAWN_CMD_ARRAY = /cmd:\s*\[[\s\S]{0,300}?\]/g;
+
+function collectSourceFiles(rootDir: string): string[] {
+  const pending = [rootDir];
+  const files: string[] = [];
+
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (!current) {
+      continue;
+    }
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const fullPath = join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name !== "node_modules") {
+          pending.push(fullPath);
+        }
+        continue;
+      }
+      if (entry.isFile() && /\.tsx?$/.test(entry.name)) {
+        files.push(fullPath);
+      }
+    }
+  }
+
+  return files;
+}
+
+function offenders(predicate: (source: string) => boolean): string[] {
+  return collectSourceFiles(SRC_DIR)
+    .map((path) => ({ path, rel: relative(SRC_DIR, path) }))
+    .filter(({ rel }) => rel !== SELF)
+    .filter(({ path }) => predicate(readFileSync(path, "utf-8")))
+    .map(({ rel }) => rel)
+    .sort();
+}
+
+describe("file URL → path guard", () => {
+  test("no path is derived from import.meta.url via .pathname", () => {
+    expect(
+      offenders((source) => IMPORT_META_URL_PATHNAME.test(source)),
+    ).toEqual([]);
+  });
+
+  test("no .pathname is passed as a spawn argument", () => {
+    expect(
+      offenders((source) =>
+        [...source.matchAll(SPAWN_CMD_ARRAY)].some((match) =>
+          match[0].includes(".pathname"),
+        ),
+      ),
+    ).toEqual([]);
+  });
+});

package/src/__tests__/filesystem-tools.test.ts

@@ -49,7 +49,7 @@ function sandboxPolicyFor(boundary: string): PathPolicy {
 // ===========================================================================
 
 describe("FileSystemOps symlink handling", () => {
-  test("read blocks symlink pointing outside boundary", () => {
+  test("read blocks symlink pointing outside boundary", async () => {
     const boundary = makeTempDir();
     const outside = makeTempDir();
     const outsideFile = join(outside, "secret.txt");
@@ -58,7 +58,7 @@ describe("FileSystemOps symlink handling", () => {
     symlinkSync(outsideFile, join(boundary, "link.txt"));
     const ops = new FileSystemOps(sandboxPolicyFor(boundary));
 
-    const result = ops.readFileSafe({ path: "link.txt" });
+    const result = await ops.readFileSafe({ path: "link.txt" });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -66,14 +66,14 @@ describe("FileSystemOps symlink handling", () => {
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
-  test("read allows symlink within boundary", () => {
+  test("read allows symlink within boundary", async () => {
     const boundary = makeTempDir();
     const realFile = join(boundary, "real.txt");
     writeFileSync(realFile, "hello");
     symlinkSync(realFile, join(boundary, "link.txt"));
 
     const ops = new FileSystemOps(sandboxPolicyFor(boundary));
-    const result = ops.readFileSafe({ path: "link.txt" });
+    const result = await ops.readFileSafe({ path: "link.txt" });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -81,13 +81,13 @@ describe("FileSystemOps symlink handling", () => {
     expect(result.value.content).toContain("hello");
   });
 
-  test("write blocks creating file under symlinked dir pointing outside", () => {
+  test("write blocks creating file under symlinked dir pointing outside", async () => {
     const boundary = makeTempDir();
     const outside = makeTempDir();
     symlinkSync(outside, join(boundary, "link-dir"));
 
     const ops = new FileSystemOps(sandboxPolicyFor(boundary));
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "link-dir/evil.txt",
       content: "bad",
     });
@@ -100,7 +100,7 @@ describe("FileSystemOps symlink handling", () => {
     expect(existsSync(join(outside, "evil.txt"))).toBe(false);
   });
 
-  test("edit blocks symlink pointing outside boundary", () => {
+  test("edit blocks symlink pointing outside boundary", async () => {
     const boundary = makeTempDir();
     const outside = makeTempDir();
     const outsideFile = join(outside, "target.txt");
@@ -108,7 +108,7 @@ describe("FileSystemOps symlink handling", () => {
     symlinkSync(outsideFile, join(boundary, "link.txt"));
 
     const ops = new FileSystemOps(sandboxPolicyFor(boundary));
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "link.txt",
       oldString: "original",
       newString: "modified",
@@ -129,12 +129,12 @@ describe("FileSystemOps symlink handling", () => {
 // ===========================================================================
 
 describe("FileSystemOps read offset/limit edge cases", () => {
-  test("offset beyond file length returns empty content", () => {
+  test("offset beyond file length returns empty content", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "short.txt"), "a\nb\nc");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "short.txt", offset: 100 });
+    const result = await ops.readFileSafe({ path: "short.txt", offset: 100 });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -142,12 +142,12 @@ describe("FileSystemOps read offset/limit edge cases", () => {
     expect(result.value.content).toBe("");
   });
 
-  test("limit of zero returns empty content", () => {
+  test("limit of zero returns empty content", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "a\nb\nc");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "file.txt", limit: 0 });
+    const result = await ops.readFileSafe({ path: "file.txt", limit: 0 });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -155,12 +155,16 @@ describe("FileSystemOps read offset/limit edge cases", () => {
     expect(result.value.content).toBe("");
   });
 
-  test("offset=1 reads from first line (1-indexed)", () => {
+  test("offset=1 reads from first line (1-indexed)", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "first\nsecond\nthird");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "file.txt", offset: 1, limit: 1 });
+    const result = await ops.readFileSafe({
+      path: "file.txt",
+      offset: 1,
+      limit: 1,
+    });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -169,12 +173,12 @@ describe("FileSystemOps read offset/limit edge cases", () => {
     expect(result.value.content).not.toContain("second");
   });
 
-  test("limit exceeding file length returns all remaining lines", () => {
+  test("limit exceeding file length returns all remaining lines", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "a\nb");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({
+    const result = await ops.readFileSafe({
       path: "file.txt",
       offset: 1,
       limit: 1000,
@@ -187,12 +191,16 @@ describe("FileSystemOps read offset/limit edge cases", () => {
     expect(result.value.content).toContain("b");
   });
 
-  test("read adds line numbers starting from offset", () => {
+  test("read adds line numbers starting from offset", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "a\nb\nc\nd\ne");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "file.txt", offset: 3, limit: 2 });
+    const result = await ops.readFileSafe({
+      path: "file.txt",
+      offset: 3,
+      limit: 2,
+    });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -210,7 +218,7 @@ describe("FileSystemOps read offset/limit edge cases", () => {
 // ===========================================================================
 
 describe("FileSystemOps edit match methods", () => {
-  test("whitespace-normalized match succeeds", () => {
+  test("whitespace-normalized match succeeds", async () => {
     const dir = makeTempDir();
     writeFileSync(
       join(dir, "file.txt"),
@@ -218,7 +226,7 @@ describe("FileSystemOps edit match methods", () => {
     );
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "file.txt",
       oldString: "function foo() {\n  return 1;\n}",
       newString: "function bar() {\n  return 2;\n}",
@@ -233,12 +241,12 @@ describe("FileSystemOps edit match methods", () => {
     expect(result.value.newContent).toContain("bar");
   });
 
-  test("fuzzy match succeeds with near-match", () => {
+  test("fuzzy match succeeds with near-match", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "function fooo() {\n  return 1;\n}\n");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "file.txt",
       oldString: "function foo() {\n  return 1;\n}",
       newString: "function bar() {\n  return 2;\n}",
@@ -253,12 +261,12 @@ describe("FileSystemOps edit match methods", () => {
     expect(result.value.similarity).toBeLessThan(1);
   });
 
-  test("edit returns actualOld and actualNew for fuzzy match", () => {
+  test("edit returns actualOld and actualNew for fuzzy match", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "function fooo() {\n  return 1;\n}\n");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "file.txt",
       oldString: "function foo() {\n  return 1;\n}",
       newString: "function bar() {\n  return 2;\n}",
@@ -278,11 +286,14 @@ describe("FileSystemOps edit match methods", () => {
 // ===========================================================================
 
 describe("FileSystemOps write content tracking", () => {
-  test("new file has empty oldContent", () => {
+  test("new file has empty oldContent", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({ path: "brand-new.txt", content: "new" });
+    const result = await ops.writeFileSafe({
+      path: "brand-new.txt",
+      content: "new",
+    });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -291,12 +302,12 @@ describe("FileSystemOps write content tracking", () => {
     expect(result.value.isNewFile).toBe(true);
   });
 
-  test("overwrite tracks oldContent and newContent", () => {
+  test("overwrite tracks oldContent and newContent", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "existing.txt"), "version 1");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "existing.txt",
       content: "version 2",
     });
@@ -309,11 +320,14 @@ describe("FileSystemOps write content tracking", () => {
     expect(result.value.isNewFile).toBe(false);
   });
 
-  test("write returns resolved absolute path", () => {
+  test("write returns resolved absolute path", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({ path: "output.txt", content: "data" });
+    const result = await ops.writeFileSafe({
+      path: "output.txt",
+      content: "data",
+    });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -395,11 +409,11 @@ describe("formatWriteSummary", () => {
 // ===========================================================================
 
 describe("FileSystemOps path traversal prevention", () => {
-  test("rejects absolute path outside boundary on read", () => {
+  test("rejects absolute path outside boundary on read", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "/etc/passwd" });
+    const result = await ops.readFileSafe({ path: "/etc/passwd" });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -407,11 +421,11 @@ describe("FileSystemOps path traversal prevention", () => {
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
-  test("rejects absolute path outside boundary on write", () => {
+  test("rejects absolute path outside boundary on write", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "/tmp/evil-write.txt",
       content: "bad",
     });
@@ -422,11 +436,11 @@ describe("FileSystemOps path traversal prevention", () => {
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
-  test("rejects absolute path outside boundary on edit", () => {
+  test("rejects absolute path outside boundary on edit", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "/etc/hosts",
       oldString: "a",
       newString: "b",
@@ -439,12 +453,12 @@ describe("FileSystemOps path traversal prevention", () => {
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
-  test("rejects dot-dot traversal embedded in path on read", () => {
+  test("rejects dot-dot traversal embedded in path on read", async () => {
     const dir = makeTempDir();
     mkdirSync(join(dir, "sub"));
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "sub/../../etc/passwd" });
+    const result = await ops.readFileSafe({ path: "sub/../../etc/passwd" });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -452,12 +466,12 @@ describe("FileSystemOps path traversal prevention", () => {
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
-  test("accepts absolute path inside boundary", () => {
+  test("accepts absolute path inside boundary", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "inside.txt"), "safe content");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: join(dir, "inside.txt") });
+    const result = await ops.readFileSafe({ path: join(dir, "inside.txt") });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -471,13 +485,13 @@ describe("FileSystemOps path traversal prevention", () => {
 // ===========================================================================
 
 describe("FileSystemOps binary file read", () => {
-  test("reads binary content as utf-8 without crashing", () => {
+  test("reads binary content as utf-8 without crashing", async () => {
     const dir = makeTempDir();
     const binaryContent = Buffer.from([0x00, 0xff, 0x89, 0x50, 0x4e, 0x47]);
     writeFileSync(join(dir, "binary.bin"), binaryContent);
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "binary.bin" });
+    const result = await ops.readFileSafe({ path: "binary.bin" });
     // Should succeed — the file is readable, even if content has replacement chars
     expect(result.ok).toBe(true);
   });
@@ -488,12 +502,12 @@ describe("FileSystemOps binary file read", () => {
 // ===========================================================================
 
 describe("FileSystemOps empty file operations", () => {
-  test("reads empty file successfully", () => {
+  test("reads empty file successfully", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "empty.txt"), "");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "empty.txt" });
+    const result = await ops.readFileSafe({ path: "empty.txt" });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -502,11 +516,11 @@ describe("FileSystemOps empty file operations", () => {
     expect(result.value.content).toBeDefined();
   });
 
-  test("write empty content creates empty file", () => {
+  test("write empty content creates empty file", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({ path: "empty.txt", content: "" });
+    const result = await ops.writeFileSafe({ path: "empty.txt", content: "" });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -515,12 +529,12 @@ describe("FileSystemOps empty file operations", () => {
     expect(readFileSync(join(dir, "empty.txt"), "utf-8")).toBe("");
   });
 
-  test("edit on empty file returns MATCH_NOT_FOUND", () => {
+  test("edit on empty file returns MATCH_NOT_FOUND", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "empty.txt"), "");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "empty.txt",
       oldString: "something",
       newString: "else",
@@ -539,12 +553,12 @@ describe("FileSystemOps empty file operations", () => {
 // ===========================================================================
 
 describe("FileSystemOps /workspace path remapping", () => {
-  test("read remaps /workspace/ path to boundary", () => {
+  test("read remaps /workspace/ path to boundary", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "workspace content");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "/workspace/file.txt" });
+    const result = await ops.readFileSafe({ path: "/workspace/file.txt" });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -552,11 +566,11 @@ describe("FileSystemOps /workspace path remapping", () => {
     expect(result.value.content).toContain("workspace content");
   });
 
-  test("write remaps /workspace/ path to boundary", () => {
+  test("write remaps /workspace/ path to boundary", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "/workspace/new.txt",
       content: "remapped",
     });
@@ -568,12 +582,12 @@ describe("FileSystemOps /workspace path remapping", () => {
     expect(readFileSync(join(dir, "new.txt"), "utf-8")).toBe("remapped");
   });
 
-  test("edit remaps /workspace/ path to boundary", () => {
+  test("edit remaps /workspace/ path to boundary", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "old content");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "/workspace/file.txt",
       oldString: "old content",
       newString: "new content",
@@ -587,11 +601,13 @@ describe("FileSystemOps /workspace path remapping", () => {
     expect(readFileSync(join(dir, "file.txt"), "utf-8")).toBe("new content");
   });
 
-  test("/workspace traversal escape is blocked", () => {
+  test("/workspace traversal escape is blocked", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "/workspace/../../../etc/passwd" });
+    const result = await ops.readFileSafe({
+      path: "/workspace/../../../etc/passwd",
+    });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -605,12 +621,12 @@ describe("FileSystemOps /workspace path remapping", () => {
 // ===========================================================================
 
 describe("FileSystemOps custom size limit", () => {
-  test("read rejects file exceeding custom limit", () => {
+  test("read rejects file exceeding custom limit", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "big.txt"), "x".repeat(500));
     const ops = new FileSystemOps(sandboxPolicyFor(dir), { sizeLimit: 100 });
 
-    const result = ops.readFileSafe({ path: "big.txt" });
+    const result = await ops.readFileSafe({ path: "big.txt" });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -618,20 +634,20 @@ describe("FileSystemOps custom size limit", () => {
     expect(result.error.code).toBe("SIZE_LIMIT_EXCEEDED");
   });
 
-  test("read accepts file within custom limit", () => {
+  test("read accepts file within custom limit", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "small.txt"), "x".repeat(50));
     const ops = new FileSystemOps(sandboxPolicyFor(dir), { sizeLimit: 100 });
 
-    const result = ops.readFileSafe({ path: "small.txt" });
+    const result = await ops.readFileSafe({ path: "small.txt" });
     expect(result.ok).toBe(true);
   });
 
-  test("write rejects content exceeding custom limit", () => {
+  test("write rejects content exceeding custom limit", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir), { sizeLimit: 100 });
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "big.txt",
       content: "x".repeat(500),
     });
@@ -642,12 +658,12 @@ describe("FileSystemOps custom size limit", () => {
     expect(result.error.code).toBe("SIZE_LIMIT_EXCEEDED");
   });
 
-  test("edit rejects file exceeding custom limit", () => {
+  test("edit rejects file exceeding custom limit", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "big.txt"), "x".repeat(500));
     const ops = new FileSystemOps(sandboxPolicyFor(dir), { sizeLimit: 100 });
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "big.txt",
       oldString: "x",
       newString: "y",
@@ -660,12 +676,12 @@ describe("FileSystemOps custom size limit", () => {
     expect(result.error.code).toBe("SIZE_LIMIT_EXCEEDED");
   });
 
-  test("no size limit when not specified (defaults to 100MB)", () => {
+  test("no size limit when not specified (defaults to 100MB)", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "x".repeat(1000));
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "file.txt" });
+    const result = await ops.readFileSafe({ path: "file.txt" });
     expect(result.ok).toBe(true);
   });
 });

package/src/__tests__/guardian-outbound-http.test.ts

@@ -440,7 +440,7 @@ describe("HTTP route: handleCreateVerificationSession (guardian path)", () => {
   test("creates inbound challenge when destination is absent", async () => {
     const result = (await handleCreateVerificationSession({
       body: { channel: "phone" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(result.success).toBe(true);
     expect(result.channel).toBe("phone");
   });
@@ -448,7 +448,7 @@ describe("HTTP route: handleCreateVerificationSession (guardian path)", () => {
   test("returns success for valid voice start", async () => {
     const result = (await handleCreateVerificationSession({
       body: { channel: "phone", destination: "+15559999999" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(result.success).toBe(true);
     expect(result.verificationSessionId).toBeDefined();
   });
@@ -471,7 +471,7 @@ describe("HTTP route: handleResendVerificationSession (guardian path)", () => {
     // Start a session first
     const startResult = (await handleCreateVerificationSession({
       body: { channel: "phone", destination: "+15556667777" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(startResult.success).toBe(true);
 
     // Expire the cooldown so resend is allowed
@@ -489,7 +489,7 @@ describe("HTTP route: handleResendVerificationSession (guardian path)", () => {
         channel: "phone",
         originConversationId: "conv-resend-http-origin",
       },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(resendResult.success).toBe(true);
     expect(resendResult.originConversationId).toBe("conv-resend-http-origin");
   });
@@ -505,7 +505,7 @@ describe("HTTP route: handleCancelVerificationSession (guardian path)", () => {
   test("returns success even when no active session exists", async () => {
     const result = (await handleCancelVerificationSession({
       body: { channel: "phone" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(result.success).toBe(true);
   });
 
@@ -513,13 +513,13 @@ describe("HTTP route: handleCancelVerificationSession (guardian path)", () => {
     // Start a session
     const startResult = (await handleCreateVerificationSession({
       body: { channel: "phone", destination: "+15558887777" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(startResult.success).toBe(true);
 
     // Cancel it
     const cancelResult = (await handleCancelVerificationSession({
       body: { channel: "phone" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(cancelResult.success).toBe(true);
   });
 });
@@ -575,7 +575,7 @@ describe("origin conversation linkage", () => {
         destination: "+15557776666",
         originConversationId: "conv-origin-http-test",
       },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(result.success).toBe(true);
     expect(result.originConversationId).toBe("conv-origin-http-test");
   });

package/src/__tests__/helpers/gateway-verification-sessions-stub.ts

@@ -139,9 +139,22 @@ export function createGatewayVerificationSessionsStub(options: {
       throwIfUnreachable("updateSessionDelivery");
       calls.updateSessionDelivery.push(args);
     },
-    findActiveSession: async () => {
+    // Honours the caller's `expectedExternalUserId` filter the way the
+    // gateway does. Returning the session for every filter would make a
+    // "someone else is verifying" test pass against a lookup that, against
+    // the real gateway, would have found nothing.
+    findActiveSession: async (...args: unknown[]) => {
       calls.sessionReads.push("findActiveSession");
       throwIfUnreachable("findActiveSession");
+      const wantedActor = (
+        args[1] as { expectedExternalUserId?: string } | undefined
+      )?.expectedExternalUserId;
+      if (
+        wantedActor !== undefined &&
+        state.activeSession?.expectedExternalUserId !== wantedActor
+      ) {
+        return null;
+      }
       return state.activeSession;
     },
     getPendingSession: async () => {