@zereight/mcp-gitlab 2.1.46 → 2.1.48

package/build/test/test-all-transport-server.js

@@ -216,11 +216,17 @@ describe('GitLab MCP Server - Streamable HTTP Transport', () => {
         cleanup();
         console.log('Client disconnected from Streamable HTTP server');
     });
-    test('should return 405 for GET /mcp', async () => {
+    test('should return 406 for GET /mcp without Accept: text/event-stream', async () => {
         const response = await fetch(`http://${HOST}:${port}/mcp`);
-        assert.strictEqual(response.status, 405, 'GET /mcp should respond with 405');
+        assert.strictEqual(response.status, 406, 'GET /mcp should respond with 406 when Accept header is missing text/event-stream');
         const body = await response.json();
-        assert.strictEqual(body?.error, 'Method Not Allowed');
+        assert.strictEqual(body?.error, 'Not Acceptable');
+    });
+    test('should return 405 for unsupported HTTP methods like PUT /mcp', async () => {
+        const response = await fetch(`http://${HOST}:${port}/mcp`, { method: 'PUT' });
+        assert.strictEqual(response.status, 405, 'PUT /mcp should respond with 405');
+        const allowHeader = response.headers.get('allow');
+        assert.ok(allowHeader?.includes('GET') && allowHeader?.includes('POST') && allowHeader?.includes('DELETE'), 'Allow header should contain GET, POST, DELETE');
     });
     test('should list tools via Streamable HTTP', async () => {
         const tools = await client.listTools();

package/build/test/test-download-attachment.js

@@ -2,6 +2,7 @@ import { describe, test, before, after } from 'node:test';
 import assert from 'node:assert';
 import { spawn } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
 const MOCK_TOKEN = 'glpat-mock-token-12345';
 const TEST_PROJECT_ID = '123';
@@ -125,6 +126,32 @@ describe('download_attachment', () => {
             raw.result.content.some(c => typeof c.text === 'string' && c.text.toLowerCase().includes('traversal'));
         assert.ok(isRpcError || isContentError, 'Should return an error mentioning directory traversal');
     });
+    test('local_path through a symlink directory is rejected', async () => {
+        const linkDir = `omc-test-symlink-${RUN_ID}`;
+        fs.rmSync(linkDir, { recursive: true, force: true });
+        fs.symlinkSync(os.tmpdir(), linkDir);
+        try {
+            const raw = await callDownloadAttachment({
+                project_id: TEST_PROJECT_ID,
+                secret: TEST_SECRET,
+                filename: 'image.png',
+                local_path: linkDir,
+            }, env);
+            const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
+                (Array.isArray(raw.result?.content)
+                    ? raw.result.content.map(c => c.text || '').join(' ')
+                    : '');
+            const lower = msg.toLowerCase();
+            assert.ok(lower.includes('symbolic') ||
+                lower.includes('symlink') ||
+                lower.includes('escapes') ||
+                lower.includes('traversal') ||
+                lower.includes('invalid'), `Expected symlink rejection, got: ${msg}`);
+        }
+        finally {
+            fs.rmSync(linkDir, { recursive: true, force: true });
+        }
+    });
     test('filename with directory traversal is rejected before writing to disk', async () => {
         const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'image.png#../../owned.txt' }, env);
         const isRpcError = typeof raw.error?.message === 'string' &&

package/build/test/test-get-file-contents.js

@@ -0,0 +1,128 @@
+import assert from "node:assert";
+import { after, before, describe, test } from "node:test";
+import { Buffer } from "node:buffer";
+import { CustomHeaderClient } from "./clients/custom-header-client.js";
+import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
+import { findMockServerPort, MockGitLabServer } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-get-file-contents-test-token";
+const TEST_PROJECT_ID = "123";
+describe("get_file_contents", { timeout: 20_000 }, () => {
+    let mockGitLab;
+    let server;
+    let mcpUrl;
+    before(async () => {
+        const binaryContent = Buffer.from([
+            0x25, 0x50, 0x44, 0x46, 0x2d, 0x31, 0x2e, 0x37, 0x0a, 0xc7, 0xff, 0xd8, 0x00,
+        ]).toString("base64");
+        const mockPort = await findMockServerPort();
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/sample.pdf`, (_req, res) => {
+            res.json({
+                file_name: "sample.pdf",
+                file_path: "sample.pdf",
+                encoding: "base64",
+                content: binaryContent,
+            });
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/README.md`, (_req, res) => {
+            res.json({
+                file_name: "README.md",
+                file_path: "README.md",
+                encoding: "base64",
+                content: Buffer.from("Hello, 世界\n", "utf8").toString("base64"),
+            });
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/empty.txt`, (_req, res) => {
+            res.json({
+                file_name: "empty.txt",
+                file_path: "empty.txt",
+                encoding: "base64",
+                content: "",
+            });
+        });
+        await mockGitLab.start();
+        const port = await findAvailablePort(3480);
+        server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port,
+            timeout: 10_000,
+            env: {
+                STREAMABLE_HTTP: "true",
+                REMOTE_AUTHORIZATION: "true",
+                GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+            },
+        });
+        mcpUrl = `http://${HOST}:${port}/mcp`;
+    });
+    after(async () => {
+        cleanupServers([server]);
+        if (mockGitLab)
+            await mockGitLab.stop();
+    });
+    test("preserves non-UTF-8 file content as base64", async () => {
+        const expectedContent = Buffer.from([
+            0x25, 0x50, 0x44, 0x46, 0x2d, 0x31, 0x2e, 0x37, 0x0a, 0xc7, 0xff, 0xd8, 0x00,
+        ]).toString("base64");
+        const client = new CustomHeaderClient({ Authorization: `Bearer ${MOCK_TOKEN}` });
+        await client.connect(mcpUrl);
+        try {
+            const result = await Promise.race([
+                client.callTool("get_file_contents", {
+                    project_id: TEST_PROJECT_ID,
+                    file_path: "sample.pdf",
+                    ref: "main",
+                }),
+                new Promise((_, reject) => {
+                    const timer = setTimeout(() => reject(new Error("get_file_contents timed out")), 5_000);
+                    timer.unref();
+                }),
+            ]);
+            const responseText = result.content?.[0]?.type === "text" ? result.content[0].text : "";
+            const file = JSON.parse(responseText);
+            assert.strictEqual(file.content, expectedContent);
+            assert.strictEqual(file.encoding, "base64");
+        }
+        finally {
+            await client.disconnect();
+        }
+    });
+    test("decodes valid UTF-8 file content", async () => {
+        const client = new CustomHeaderClient({ Authorization: `Bearer ${MOCK_TOKEN}` });
+        await client.connect(mcpUrl);
+        try {
+            const result = await client.callTool("get_file_contents", {
+                project_id: TEST_PROJECT_ID,
+                file_path: "README.md",
+                ref: "main",
+            });
+            const responseText = result.content?.[0]?.type === "text" ? result.content[0].text : "";
+            const file = JSON.parse(responseText);
+            assert.strictEqual(file.content, "Hello, 世界\n");
+            assert.strictEqual(file.encoding, "utf8");
+        }
+        finally {
+            await client.disconnect();
+        }
+    });
+    test("decodes empty file content as UTF-8", async () => {
+        const client = new CustomHeaderClient({ Authorization: `Bearer ${MOCK_TOKEN}` });
+        await client.connect(mcpUrl);
+        try {
+            const result = await client.callTool("get_file_contents", {
+                project_id: TEST_PROJECT_ID,
+                file_path: "empty.txt",
+                ref: "main",
+            });
+            const responseText = result.content?.[0]?.type === "text" ? result.content[0].text : "";
+            const file = JSON.parse(responseText);
+            assert.strictEqual(file.content, "");
+            assert.strictEqual(file.encoding, "utf8");
+        }
+        finally {
+            await client.disconnect();
+        }
+    });
+});

package/build/test/test-job-artifacts.js

@@ -123,8 +123,9 @@ describe('job artifacts tools', () => {
         });
         await mockGitLab.start();
         mockGitLabUrl = mockGitLab.getUrl();
-        // Create a temp directory for download tests
-        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gitlab-mcp-test-'));
+        // Relative temp dir — absolute local_path is rejected as traversal
+        tmpDir = `gitlab-mcp-test-artifacts-${process.pid}`;
+        fs.mkdirSync(tmpDir, { recursive: true });
     });
     after(async () => {
         await mockGitLab.stop();
@@ -167,6 +168,30 @@ describe('job artifacts tools', () => {
         assert.ok(fs.existsSync(result.file_path), `File should exist at ${result.file_path}`);
         assert.ok(fs.existsSync(nestedLocalPath), `Directory should be created at ${nestedLocalPath}`);
     });
+    test('download_job_artifacts rejects local_path with directory traversal', async () => {
+        await assert.rejects(() => callTool('download_job_artifacts', { project_id: TEST_PROJECT_ID, job_id: TEST_JOB_ID, local_path: '../../../tmp' }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        }), (err) => {
+            const msg = String(err.message || err).toLowerCase();
+            return msg.includes('traversal') || msg.includes('invalid');
+        });
+    });
+    test('download_job_artifacts rejects symlink local_path escape', async () => {
+        const linkName = path.join(tmpDir, 'symlink-escape');
+        fs.symlinkSync(os.tmpdir(), linkName);
+        await assert.rejects(() => callTool('download_job_artifacts', { project_id: TEST_PROJECT_ID, job_id: TEST_JOB_ID, local_path: linkName }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        }), (err) => {
+            const msg = String(err.message || err).toLowerCase();
+            return (msg.includes('symbolic') ||
+                msg.includes('symlink') ||
+                msg.includes('escapes') ||
+                msg.includes('traversal') ||
+                msg.includes('invalid'));
+        });
+    });
     test('get_job_artifact_file returns file content', async () => {
         const result = await callTool('get_job_artifact_file', {
             project_id: TEST_PROJECT_ID,

package/build/test/test-merge-request-approval-state-tools.js

@@ -6,6 +6,7 @@ const MOCK_TOKEN = "glpat-mock-token-approval";
 const TEST_PROJECT_ID = "123";
 const TEST_MR_IID_WITH_FALLBACK = "88";
 const TEST_MR_IID_WITH_APPROVAL_STATE = "89";
+const TEST_MR_IID_WITHOUT_RULES = "90";
 async function callTool(toolName, args, env) {
     return new Promise((resolve, reject) => {
         const proc = spawn("node", ["build/index.js"], {
@@ -133,6 +134,33 @@ describe("merge request approval state tools", () => {
                 ],
             });
         });
+        // A project without approval rules answers 200 with an empty rules array, while
+        // the approval itself is only visible on /approvals.
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/merge_requests/${TEST_MR_IID_WITHOUT_RULES}/approval_state`, (_req, res) => {
+            res.json({
+                approval_rules_overwritten: false,
+                rules: [],
+            });
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/merge_requests/${TEST_MR_IID_WITHOUT_RULES}/approvals`, (_req, res) => {
+            res.json({
+                approved: true,
+                user_has_approved: false,
+                user_can_approve: true,
+                approved_by: [
+                    {
+                        user: {
+                            id: "35",
+                            username: "sergey.kravchenya",
+                            name: "Sergey Kravchenya",
+                            state: "active",
+                            avatar_url: "https://gitlab.mock/uploads/avatar.png",
+                            web_url: "https://gitlab.mock/sergey.kravchenya",
+                        },
+                    },
+                ],
+            });
+        });
         await mockGitLab.start();
         mockGitLabUrl = mockGitLab.getUrl();
     });
@@ -153,6 +181,20 @@ describe("merge request approval state tools", () => {
         assert.ok(Array.isArray(result.approved_by));
         assert.strictEqual(result.approved_by[0].username, "sergey.kravchenya");
     });
+    test("finds approvers via approvals when approval_state reports no rules", async () => {
+        const result = await callTool("get_merge_request_approval_state", {
+            project_id: TEST_PROJECT_ID,
+            merge_request_iid: TEST_MR_IID_WITHOUT_RULES,
+        }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        });
+        assert.strictEqual(result.source_endpoint, "approvals");
+        assert.strictEqual(result.approved, true);
+        assert.deepStrictEqual(result.approved_by_usernames, ["sergey.kravchenya"]);
+        assert.ok(Array.isArray(result.approved_by));
+        assert.strictEqual(result.approved_by[0].username, "sergey.kravchenya");
+    });
     test("returns deduplicated approvers from approval_state rules", async () => {
         const result = await callTool("get_merge_request_approval_state", {
             project_id: TEST_PROJECT_ID,

package/build/test/test-upload-markdown.js

@@ -89,7 +89,7 @@ describe('upload_markdown', () => {
         await mockGitLab.stop();
     });
     test('Content-Type is multipart/form-data with a boundary', async () => {
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-ct-test.txt');
+        const tmpFile = `mcp-upload-ct-test-${process.pid}.txt`;
         fs.writeFileSync(tmpFile, 'content-type test');
         try {
             await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
@@ -102,7 +102,7 @@ describe('upload_markdown', () => {
         }
     });
     test('multipart body contains a "file" field with the file content', async () => {
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-body-test.txt');
+        const tmpFile = `mcp-upload-body-test-${process.pid}.txt`;
         const fileContent = 'hello from multipart upload test';
         fs.writeFileSync(tmpFile, fileContent);
         try {
@@ -116,19 +116,19 @@ describe('upload_markdown', () => {
         }
     });
     test('multipart body includes the original filename', async () => {
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-filename-check.txt');
+        const tmpFile = `mcp-upload-filename-check-${process.pid}.txt`;
         fs.writeFileSync(tmpFile, 'filename check');
         try {
             await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
             assert.ok(lastRawBody, 'Request body must be captured');
-            assert.ok(lastRawBody.includes('mcp-upload-filename-check.txt'), 'Multipart body should include the original filename');
+            assert.ok(lastRawBody.includes(`mcp-upload-filename-check-${process.pid}.txt`), 'Multipart body should include the original filename');
         }
         finally {
             fs.unlinkSync(tmpFile);
         }
     });
     test('returns markdown, url, alt, and full_path from upload response', async () => {
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-response-test.txt');
+        const tmpFile = `mcp-upload-response-test-${process.pid}.txt`;
         fs.writeFileSync(tmpFile, 'response field test');
         try {
             const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
@@ -148,7 +148,7 @@ describe('upload_markdown', () => {
     test('accepts upload responses without id from older self-hosted GitLab', async () => {
         const { id: _id, ...idlessUploadResponse } = MOCK_UPLOAD_RESPONSE;
         uploadResponse = idlessUploadResponse;
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-idless-response-test.txt');
+        const tmpFile = `mcp-upload-idless-response-test-${process.pid}.txt`;
         fs.writeFileSync(tmpFile, 'idless response field test');
         try {
             const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
@@ -167,9 +167,40 @@ describe('upload_markdown', () => {
         }
     });
     test('returns an error when the file does not exist', async () => {
-        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '/nonexistent/no-such-file.txt' }, env);
+        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: `mcp-upload-missing-${process.pid}.txt` }, env);
         const hasError = typeof raw.error?.message === 'string' ||
             raw.result?.content?.some(c => c.text && (c.text.toLowerCase().includes('not found') || c.text.toLowerCase().includes('error')));
         assert.ok(hasError, 'Should return an error for a nonexistent file path');
     });
+    test('rejects absolute file_path (path traversal / arbitrary read)', async () => {
+        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '/etc/passwd' }, env);
+        const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
+            (raw.result?.content?.map(c => c.text || '').join(' ') || '');
+        assert.ok(msg.toLowerCase().includes('traversal') || msg.toLowerCase().includes('invalid'), `Expected traversal rejection, got: ${msg}`);
+    });
+    test('rejects file_path with ".." traversal', async () => {
+        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '../../../etc/passwd' }, env);
+        const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
+            (raw.result?.content?.map(c => c.text || '').join(' ') || '');
+        assert.ok(msg.toLowerCase().includes('traversal') || msg.toLowerCase().includes('invalid'), `Expected traversal rejection, got: ${msg}`);
+    });
+    test('rejects file_path that is a symlink escape', async () => {
+        const linkName = `mcp-upload-symlink-${process.pid}.txt`;
+        const target = path.join(os.tmpdir(), `mcp-upload-secret-${process.pid}.txt`);
+        fs.writeFileSync(target, 'secret-content');
+        fs.symlinkSync(target, linkName);
+        try {
+            const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: linkName }, env);
+            const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
+                (raw.result?.content?.map(c => c.text || '').join(' ') || '');
+            assert.ok(msg.toLowerCase().includes('symbolic') ||
+                msg.toLowerCase().includes('symlink') ||
+                msg.toLowerCase().includes('escapes') ||
+                msg.toLowerCase().includes('invalid'), `Expected symlink rejection, got: ${msg}`);
+        }
+        finally {
+            fs.rmSync(linkName, { force: true });
+            fs.rmSync(target, { force: true });
+        }
+    });
 });

package/build/test/utils/helpers-path.test.js

@@ -0,0 +1,104 @@
+import { describe, test } from "node:test";
+import assert from "node:assert";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { assertSafeRelativePath, openSafeOutputWriteStream, readSafeExistingFile, resolveSafeExistingPath, resolveSafeOutputDir, resolveSafeOutputFile, } from "../../utils/helpers.js";
+describe("assertSafeRelativePath", () => {
+    test("allows relative paths", () => {
+        assert.strictEqual(assertSafeRelativePath("uploads"), "uploads");
+        assert.strictEqual(assertSafeRelativePath("uploads/nested"), path.normalize("uploads/nested"));
+    });
+    test("rejects absolute paths", () => {
+        assert.throws(() => assertSafeRelativePath("/etc/passwd", "file_path"), /traversal/);
+    });
+    test("rejects parent-directory traversal", () => {
+        assert.throws(() => assertSafeRelativePath("../../../tmp", "local_path"), /traversal/);
+        assert.throws(() => assertSafeRelativePath("foo/../../etc", "local_path"), /traversal/);
+    });
+});
+describe("resolveSafeExistingPath / resolveSafeOutputDir", () => {
+    let base;
+    test("setup base dir", () => {
+        base = fs.mkdtempSync(path.join(os.tmpdir(), "safe-path-"));
+    });
+    test("resolves an existing file inside the base", () => {
+        const file = path.join(base, "ok.txt");
+        fs.writeFileSync(file, "hello");
+        const resolved = resolveSafeExistingPath("ok.txt", "file_path", base);
+        assert.strictEqual(resolved, fs.realpathSync(file));
+    });
+    test("rejects symlink file escape on read", () => {
+        const target = path.join(os.tmpdir(), `outside-target-${process.pid}.txt`);
+        fs.writeFileSync(target, "secret");
+        fs.symlinkSync(target, path.join(base, "link.txt"));
+        try {
+            assert.throws(() => resolveSafeExistingPath("link.txt", "file_path", base), /symbolic links|escapes/);
+        }
+        finally {
+            fs.unlinkSync(target);
+        }
+    });
+    test("rejects symlink directory escape on write", () => {
+        fs.symlinkSync(os.tmpdir(), path.join(base, "escape-dir"));
+        assert.throws(() => resolveSafeOutputDir("escape-dir", "local_path", base), /symbolic links|escapes/);
+    });
+    test("creates nested output dirs that stay inside the base", () => {
+        const out = resolveSafeOutputDir(path.join("artifacts", "run-1"), "local_path", base);
+        const baseReal = fs.realpathSync(base);
+        const rel = path.relative(baseReal, out);
+        assert.ok(rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel)));
+        assert.ok(fs.statSync(out).isDirectory());
+    });
+    test("resolveSafeOutputFile rejects destination file symlink", () => {
+        const outDir = path.join(base, "out");
+        fs.mkdirSync(outDir, { recursive: true });
+        const target = path.join(os.tmpdir(), `outside-write-${process.pid}.txt`);
+        fs.writeFileSync(target, "before");
+        fs.symlinkSync(target, path.join(outDir, "payload.bin"));
+        try {
+            assert.throws(() => resolveSafeOutputFile("payload.bin", "out", "local_path", base), /symbolic links/);
+        }
+        finally {
+            fs.unlinkSync(target);
+        }
+    });
+    test("resolveSafeOutputFile returns contained path for new files", () => {
+        const dest = resolveSafeOutputFile("fresh.bin", "downloads", "local_path", base);
+        assert.ok(dest.startsWith(fs.realpathSync(base) + path.sep));
+        assert.ok(dest.endsWith(`${path.sep}fresh.bin`));
+    });
+    test("anchors to cwd snapshot when baseDir is omitted", () => {
+        const nested = path.join(base, "anchored");
+        fs.mkdirSync(nested, { recursive: true });
+        const file = path.join(nested, "data.txt");
+        fs.writeFileSync(file, "anchored");
+        const originalCwd = process.cwd();
+        try {
+            process.chdir(nested);
+            const resolved = resolveSafeExistingPath("data.txt", "file_path");
+            assert.strictEqual(resolved, fs.realpathSync(file));
+        }
+        finally {
+            process.chdir(originalCwd);
+        }
+    });
+    test("readSafeExistingFile reads without returning a reusable path", () => {
+        const file = path.join(base, "inline.txt");
+        fs.writeFileSync(file, "payload");
+        const { buffer, basename } = readSafeExistingFile("inline.txt", "file_path", base);
+        assert.strictEqual(buffer.toString(), "payload");
+        assert.strictEqual(basename, "inline.txt");
+    });
+    test("openSafeOutputWriteStream writes without a separate createWriteStream call", async () => {
+        const { stream, path: dest } = openSafeOutputWriteStream("streamed.bin", "downloads", "local_path", base);
+        await new Promise((resolve, reject) => {
+            stream.on("error", reject);
+            stream.end("streamed", () => resolve());
+        });
+        assert.strictEqual(fs.readFileSync(dest, "utf8"), "streamed");
+    });
+    test("cleanup base dir", () => {
+        fs.rmSync(base, { recursive: true, force: true });
+    });
+});