cabloy 5.1.203 → 5.1.205

package/repo-e2e/scripts/managedTest.test.ts

@@ -0,0 +1,389 @@
+import type { Browser, BrowserServer, BrowserType, ConnectOptions } from '@playwright/test';
+import type { ChildProcess } from 'node:child_process';
+
+import { test as vanillaTest } from '@playwright/test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, realpath, rm, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import type { TestClaimEvent } from '../../vona/packages-vona/vona-core/src/lib/core/testClaim.ts';
+
+import { discoverBrowserProfile, test as managedTest, useManagedBrowser } from './managedTest.ts';
+
+const runId = '20261014010203-a1b2c3d4';
+
+async function fixture(
+  options: {
+    fault?: string;
+    profile?: string;
+    group?: number;
+    noProfile?: boolean;
+    exited?: boolean;
+  } = {},
+) {
+  const root = await realpath(await mkdtemp(join(tmpdir(), 'cabloy-managed-browser-')));
+  const projectPath = join(root, 'vona');
+  const dataRoot = join(projectPath, `.app-test-${runId}`);
+  const temporaryRoot = join(dataRoot, 'tmp');
+  await mkdir(temporaryRoot, { recursive: true });
+  await writeFile(join(dataRoot, '.vona-test-owner'), `${runId}\n`);
+  const events: TestClaimEvent[] = [];
+  const calls: string[] = [];
+  const profile = options.profile ?? join(temporaryRoot, 'playwright_chromiumdev_profile-fake');
+  const browser = { newContext: async () => ({ close: async () => {} }) } as unknown as Browser;
+  let launchedOptions: Parameters<BrowserType['launchServer']>[0];
+  let connectedOptions: ConnectOptions | undefined;
+  const server = {
+    process: () =>
+      ({
+        pid: 4242,
+        exitCode: options.exited ? 1 : null,
+        signalCode: null,
+        spawnargs: options.noProfile
+          ? ['webkit', '--no-startup-window']
+          : ['chromium', `--user-data-dir=${profile}`],
+      }) as ChildProcess,
+    wsEndpoint: () => 'ws://127.0.0.1/fake-token-never-journaled',
+    close: async () => {
+      calls.push('close');
+      if (options.fault === 'close') throw new Error('close failed');
+    },
+  } as unknown as BrowserServer;
+  const browserType = {
+    launchServer: async (launchOptions: Parameters<BrowserType['launchServer']>[0]) => {
+      calls.push('launch');
+      launchedOptions = launchOptions;
+      if (options.fault === 'launch') throw new Error('launch failed after possible spawn');
+      return server;
+    },
+    connect: async (_endpoint: string, connectOptions: ConnectOptions | undefined) => {
+      calls.push('connect');
+      connectedOptions = connectOptions;
+      if (options.fault === 'connect') throw new Error('connect failed');
+      return browser;
+    },
+  };
+  const dependencies = {
+    env: {
+      META_MODE: 'test',
+      VONA_TEST_RUN_ID: runId,
+      VONA_TEST_CLAIM_URL: 'http://127.0.0.1:1234/event',
+      VONA_TEST_CLAIM_TOKEN: 'a'.repeat(64),
+      TMPDIR: temporaryRoot,
+    },
+    projectPath,
+    sendEvent: async (_env: NodeJS.ProcessEnv, event: TestClaimEvent) => {
+      const stage = event.type === 'process' ? event.process.stage : event.type;
+      calls.push(stage);
+      if (options.fault === stage) throw new Error(`${stage} acknowledgement failed`);
+      events.push(structuredClone(event));
+    },
+    inspectProcess: async (pid: number) => {
+      calls.push('inspect');
+      if (options.fault === 'inspect') throw new Error('inspection failed');
+      return {
+        pid,
+        pgid: options.group ?? pid,
+        startTime: 'Wed Oct 14 01:02:03 2026',
+        host: 'test-host',
+        state: 'S',
+        args: '',
+      };
+    },
+    waitForGroupExit: async (pgid: number) => {
+      calls.push('wait');
+      assert.equal(pgid, 4242);
+      if (options.fault === 'wait') throw new Error('group still live or inspection failed');
+    },
+  };
+  return {
+    root,
+    dataRoot,
+    temporaryRoot,
+    dependencies,
+    events,
+    calls,
+    browser,
+    browserOptions: { browserType, launchOptions: {}, headless: true, channel: undefined },
+    launchedOptions: () => launchedOptions,
+    connectedOptions: () => connectedOptions,
+    dispose: () => rm(root, { recursive: true, force: true }),
+  };
+}
+
+if (process.env.VONA_TEST_RUN_ID === undefined) {
+  test('unmanaged application imports preserve the exact vanilla Playwright fixtures', () => {
+    assert.equal(managedTest, vanillaTest);
+  });
+}
+
+test('registers launch intent and complete identity before use; closes and drains before reporting', async () => {
+  const f = await fixture();
+  try {
+    await useManagedBrowser(
+      f.browserOptions,
+      async browser => {
+        f.calls.push('use');
+        assert.equal(browser, f.browser);
+        const extraContext = await browser.newContext();
+        await extraContext.close();
+      },
+      f.dependencies,
+    );
+    assert.deepEqual(f.calls, [
+      'pending',
+      'launch',
+      'inspect',
+      'registered',
+      'connect',
+      'use',
+      'close',
+      'wait',
+      'drained',
+    ]);
+    assert.equal(f.events.length, 3);
+    const records = f.events.map(event => {
+      assert.equal(event.type, 'process');
+      return (event as Extract<TestClaimEvent, { type: 'process' }>).process;
+    });
+    assert.equal(records[0].profilePath, f.temporaryRoot);
+    assert.equal(records[1].pid, 4242);
+    assert.equal(records[1].pgid, 4242);
+    assert.equal(records[1].host, 'test-host');
+    assert.equal(records[1].startTime, 'Wed Oct 14 01:02:03 2026');
+    assert.equal(
+      records[1].profilePath,
+      join(f.temporaryRoot, 'playwright_chromiumdev_profile-fake'),
+    );
+    assert.equal(records[0].id, records[1].id);
+    assert.equal(records[1].id, records[2].id);
+    assert.doesNotMatch(JSON.stringify(f.events), /private-token|fake-token|ws:\/\//);
+  } finally {
+    await f.dispose();
+  }
+});
+
+test('preserves public launch options, explicit headless/channel overrides, and slowMo', async () => {
+  const f = await fixture();
+  try {
+    const args = ['--disable-dev-shm-usage'];
+    const launchOptions = {
+      args,
+      channel: 'chrome',
+      headless: true,
+      slowMo: 17,
+      timeout: 1234,
+      env: { CUSTOM_BROWSER_ENV: 'keep', TMPDIR: '/unowned' },
+    };
+    await useManagedBrowser(
+      { ...f.browserOptions, launchOptions, headless: false, channel: 'msedge' },
+      async () => {},
+      f.dependencies,
+    );
+    assert.deepEqual(f.launchedOptions(), {
+      handleSIGINT: false,
+      args,
+      channel: 'msedge',
+      headless: false,
+      timeout: 1234,
+      env: { CUSTOM_BROWSER_ENV: 'keep', TMPDIR: f.temporaryRoot },
+    });
+    assert.deepEqual(f.connectedOptions(), { slowMo: 17 });
+    assert.equal(launchOptions.env.TMPDIR, '/unowned');
+  } finally {
+    await f.dispose();
+  }
+});
+
+for (const fault of ['pending', 'launch', 'inspect', 'registered', 'close', 'wait', 'drained']) {
+  test(`retains uncertain process evidence on ${fault} failure`, async () => {
+    const f = await fixture({ fault });
+    try {
+      await assert.rejects(useManagedBrowser(f.browserOptions, async () => {}, f.dependencies));
+      assert.ok(
+        !f.events.some(event => event.type === 'process' && event.process.stage === 'drained'),
+      );
+      if (fault === 'pending') assert.ok(!f.calls.includes('launch'));
+      if (['launch', 'inspect', 'registered'].includes(fault)) {
+        assert.deepEqual(
+          f.events.map(event => event.type === 'process' && event.process.stage),
+          ['pending'],
+        );
+        assert.ok(!f.calls.includes('use'));
+      }
+      if (['inspect', 'registered'].includes(fault)) assert.ok(f.calls.includes('close'));
+      if (fault === 'close') assert.ok(!f.calls.includes('wait'));
+    } finally {
+      await f.dispose();
+    }
+  });
+}
+
+for (const failure of ['connect', 'use']) {
+  test(`closes and verifies the registered group on ${failure} failure`, async () => {
+    const f = await fixture({ fault: failure });
+    try {
+      await assert.rejects(
+        useManagedBrowser(
+          f.browserOptions,
+          async () => {
+            throw new Error('use failed');
+          },
+          f.dependencies,
+        ),
+      );
+      assert.deepEqual(f.calls.slice(-3), ['close', 'wait', 'drained']);
+    } finally {
+      await f.dispose();
+    }
+  });
+}
+
+test('refuses a shared browser group before connection or drainage acknowledgement', async () => {
+  const f = await fixture({ group: 1234 });
+  try {
+    await assert.rejects(
+      useManagedBrowser(f.browserOptions, async () => {}, f.dependencies),
+      /independent live process group/,
+    );
+    assert.deepEqual(f.calls, ['pending', 'launch', 'inspect', 'close']);
+  } finally {
+    await f.dispose();
+  }
+});
+
+test('refuses an actual profile escaping the pending run area', async () => {
+  const f = await fixture({ profile: '/tmp/unowned-browser-profile' });
+  try {
+    await assert.rejects(
+      useManagedBrowser(f.browserOptions, async () => {}, f.dependencies),
+      /outside its run-owned area/,
+    );
+    assert.deepEqual(f.calls, ['pending', 'launch', 'inspect', 'close']);
+  } finally {
+    await f.dispose();
+  }
+});
+
+for (const invalid of ['tmpdir', 'owner', 'transport', 'connect', 'symlink']) {
+  test(`refuses invalid ${invalid} before launching`, async () => {
+    const f = await fixture();
+    try {
+      if (invalid === 'tmpdir') f.dependencies.env.TMPDIR = '/tmp/unowned';
+      if (invalid === 'owner')
+        await writeFile(join(f.dataRoot, '.vona-test-owner'), 'another-run\n');
+      if (invalid === 'transport') f.dependencies.env.VONA_TEST_CLAIM_TOKEN = '';
+      if (invalid === 'symlink') {
+        await rm(f.temporaryRoot, { recursive: true });
+        await symlink(f.root, f.temporaryRoot);
+      }
+      const options =
+        invalid === 'connect'
+          ? { ...f.browserOptions, connectOptions: { wsEndpoint: 'ws://external/browser' } }
+          : f.browserOptions;
+      await assert.rejects(useManagedBrowser(options, async () => {}, f.dependencies));
+      assert.deepEqual(f.calls, []);
+    } finally {
+      await f.dispose();
+    }
+  });
+}
+
+test('registers the run-owned profile area when a browser has no argv profile flag', async () => {
+  const f = await fixture({ noProfile: true });
+  try {
+    await useManagedBrowser(f.browserOptions, async () => {}, f.dependencies);
+    assert.ok(
+      f.events.every(
+        event => event.type === 'process' && event.process.profilePath === f.temporaryRoot,
+      ),
+    );
+  } finally {
+    await f.dispose();
+  }
+});
+
+test('does not register an already-exited child as a potentially reused PID', async () => {
+  const f = await fixture({ exited: true });
+  try {
+    await assert.rejects(
+      useManagedBrowser(f.browserOptions, async () => {}, f.dependencies),
+      /no live process identity/,
+    );
+    assert.deepEqual(f.calls, ['pending', 'launch', 'close']);
+  } finally {
+    await f.dispose();
+  }
+});
+
+for (const area of ['downloadsPath', 'tracesDir', 'artifactsDir'] as const) {
+  test(`allows owned ${area} and rejects external ${area} before launch`, async () => {
+    const f = await fixture();
+    try {
+      await assert.rejects(
+        useManagedBrowser(
+          { ...f.browserOptions, launchOptions: { [area]: '/unowned/browser-output' } },
+          async () => {},
+          f.dependencies,
+        ),
+        /outside its run-owned area/,
+      );
+      assert.deepEqual(f.calls, []);
+      const owned = join(f.dataRoot, area);
+      await useManagedBrowser(
+        { ...f.browserOptions, launchOptions: { [area]: owned } },
+        async () => {},
+        f.dependencies,
+      );
+      assert.equal(f.launchedOptions()?.[area], owned);
+    } finally {
+      await f.dispose();
+    }
+  });
+}
+
+test('rejects an explicit external profile argument before launch', async () => {
+  const f = await fixture();
+  try {
+    await assert.rejects(
+      useManagedBrowser(
+        {
+          ...f.browserOptions,
+          launchOptions: { args: ['--user-data-dir=/unowned/profile'], ignoreDefaultArgs: true },
+        },
+        async () => {},
+        f.dependencies,
+      ),
+      /outside its run-owned area/,
+    );
+    assert.deepEqual(f.calls, []);
+  } finally {
+    await f.dispose();
+  }
+});
+
+test('discovers exact Chromium and Firefox argv profiles; uses the temporary area for WebKit', () => {
+  assert.equal(
+    discoverBrowserProfile(['browser', '--user-data-dir=/run/tmp/with spaces']),
+    '/run/tmp/with spaces',
+  );
+  assert.equal(
+    discoverBrowserProfile(['browser', '--user-data-dir', '/run/tmp/chromium']),
+    '/run/tmp/chromium',
+  );
+  assert.equal(
+    discoverBrowserProfile(['browser', '-profile', '/run/tmp/firefox']),
+    '/run/tmp/firefox',
+  );
+  assert.equal(
+    discoverBrowserProfile(['browser', '--profile=/run/tmp/firefox']),
+    '/run/tmp/firefox',
+  );
+  assert.equal(
+    discoverBrowserProfile(['browser', '--profile', '/run/tmp/firefox with spaces']),
+    '/run/tmp/firefox with spaces',
+  );
+  assert.equal(discoverBrowserProfile(['browser', '--no-startup-window']), undefined);
+});

package/repo-e2e/scripts/managedTest.ts

@@ -0,0 +1,210 @@
+import type {
+  Browser,
+  BrowserType,
+  ConnectOptions,
+  LaunchOptions,
+  PlaywrightWorkerOptions,
+} from '@playwright/test';
+
+import { expect, test as baseTest } from '@playwright/test';
+import { randomUUID } from 'node:crypto';
+import { lstatSync } from 'node:fs';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import type { TestProcessSnapshot } from '../../scripts/testClaimProcesses.ts';
+import type {
+  TestClaimEvent,
+  TestClaimProcess,
+} from '../../vona/packages-vona/vona-core/src/lib/core/testClaim.ts';
+
+import {
+  inspectTestProcess,
+  waitForTestProcessGroupExit,
+} from '../../scripts/testClaimProcesses.ts';
+import {
+  assertTestClaimSafePath,
+  getTestClaimPaths,
+  hasTestClaimTransport,
+  sendTestClaimEvent,
+} from '../../vona/packages-vona/vona-core/src/lib/core/testClaim.ts';
+import { assertTestRunOwner } from '../../vona/packages-vona/vona-core/src/lib/core/testIsolation.ts';
+
+const projectPath = fileURLToPath(new URL('../../vona', import.meta.url));
+
+interface ManagedBrowserType {
+  launchServer: BrowserType['launchServer'];
+  connect: (wsEndpoint: string, options?: ConnectOptions) => Promise<Browser>;
+}
+interface ManagedBrowserOptions {
+  browserType: ManagedBrowserType;
+  launchOptions: LaunchOptions;
+  headless: boolean;
+  channel: string | undefined;
+  connectOptions?: PlaywrightWorkerOptions['connectOptions'];
+}
+interface ManagedBrowserDependencies {
+  env: NodeJS.ProcessEnv;
+  projectPath: string;
+  sendEvent: (env: NodeJS.ProcessEnv, event: TestClaimEvent) => Promise<void>;
+  inspectProcess: (pid: number) => Promise<TestProcessSnapshot>;
+  waitForGroupExit: (pgid: number) => Promise<void>;
+}
+
+function assertWithin(root: string, target: string) {
+  const tail = relative(root, target);
+  if (
+    !isAbsolute(target) ||
+    resolve(target) !== target ||
+    tail === '..' ||
+    tail.startsWith(`..${sep}`) ||
+    isAbsolute(tail)
+  ) {
+    throw new Error('Managed browser path is outside its run-owned area');
+  }
+  assertTestClaimSafePath(target);
+}
+
+/** Public ChildProcess.spawnargs preserves argument boundaries, unlike ps output. */
+export function discoverBrowserProfile(spawnargs: readonly string[]): string | undefined {
+  for (let index = 0; index < spawnargs.length; index++) {
+    const argument = spawnargs[index];
+    if (argument.startsWith('--user-data-dir=')) return argument.slice('--user-data-dir='.length);
+    if (['--user-data-dir', '--profile', '-profile'].includes(argument))
+      return spawnargs[index + 1];
+    if (argument.startsWith('--profile=') || argument.startsWith('-profile='))
+      return argument.slice(argument.indexOf('=') + 1);
+  }
+  // ps flattens argument boundaries and cannot prove a path containing spaces.
+  // When no public argv flag is available (e.g. nonpersistent WebKit), retain
+  // the inherited run-owned temporary area as the profile boundary.
+  return undefined;
+}
+
+/** Exposed for focused tests with fake launchers; application specs use test below. */
+export async function useManagedBrowser(
+  options: ManagedBrowserOptions,
+  use: (browser: Browser) => Promise<void>,
+  dependencies: ManagedBrowserDependencies = {
+    env: process.env,
+    projectPath,
+    sendEvent: sendTestClaimEvent,
+    inspectProcess: inspectTestProcess,
+    waitForGroupExit: waitForTestProcessGroupExit,
+  },
+) {
+  const { env } = dependencies;
+  const runId = env.VONA_TEST_RUN_ID;
+  if (!runId || !hasTestClaimTransport(env)) {
+    throw new Error('Managed browser requires an isolated test claim transport');
+  }
+  if (options.connectOptions)
+    throw new Error('Managed E2E cannot use an external browser connection');
+  const { dataRoot } = getTestClaimPaths(dependencies.projectPath, runId);
+  const temporaryRoot = resolve(dataRoot, 'tmp');
+  assertTestRunOwner(dataRoot, runId);
+  if (env.TMPDIR !== temporaryRoot || !lstatSync(temporaryRoot).isDirectory()) {
+    throw new Error('Managed browser requires the inherited run-owned TMPDIR');
+  }
+  assertWithin(dataRoot, temporaryRoot);
+
+  const { slowMo, ...launchOptions } = options.launchOptions;
+  const requestedProfile = discoverBrowserProfile(launchOptions.args ?? []);
+  if (requestedProfile !== undefined) assertWithin(temporaryRoot, requestedProfile);
+  for (const area of [
+    launchOptions.downloadsPath,
+    launchOptions.tracesDir,
+    launchOptions.artifactsDir,
+  ]) {
+    if (area !== undefined) assertWithin(dataRoot, area);
+  }
+  // Browser profile creation happens in the Playwright worker's inherited
+  // TMPDIR. A custom browser environment must not redirect child temp writes.
+  if (launchOptions.env) launchOptions.env = { ...launchOptions.env, TMPDIR: temporaryRoot };
+  const processRecord: TestClaimProcess = {
+    id: randomUUID(),
+    role: 'browser',
+    stage: 'pending',
+    profilePath: temporaryRoot,
+  };
+  // Acknowledgement precedes spawning. A rejected launch leaves this intent
+  // pending: launchServer may have spawned before it rejects or the worker dies.
+  await dependencies.sendEvent(env, { type: 'process', process: processRecord });
+  const server = await options.browserType.launchServer({
+    handleSIGINT: false,
+    ...launchOptions,
+    headless: options.headless,
+    ...(options.channel === undefined ? {} : { channel: options.channel }),
+  });
+  let registration: TestClaimProcess | undefined;
+  try {
+    const child = server.process();
+    if (!child.pid || child.exitCode !== null || child.signalCode !== null) {
+      throw new Error('Managed browser server has no live process identity');
+    }
+    const identity = await dependencies.inspectProcess(child.pid);
+    if (
+      child.exitCode !== null ||
+      child.signalCode !== null ||
+      identity.pid !== child.pid ||
+      identity.pgid !== child.pid ||
+      !identity.startTime ||
+      identity.state.startsWith('Z')
+    ) {
+      throw new Error('Managed browser has no independent live process group');
+    }
+    const profilePath = discoverBrowserProfile(child.spawnargs) ?? temporaryRoot;
+    assertWithin(temporaryRoot, profilePath);
+    const record: TestClaimProcess = {
+      ...processRecord,
+      stage: 'registered',
+      pid: identity.pid,
+      pgid: identity.pgid,
+      startTime: identity.startTime,
+      host: identity.host,
+      profilePath,
+    };
+    await dependencies.sendEvent(env, { type: 'process', process: record });
+    registration = record;
+    const browser = await options.browserType.connect(server.wsEndpoint(), { slowMo });
+    await use(browser);
+  } finally {
+    // Never turn a pending launch into drainage proof, even if a local close
+    // succeeds: the runner may not have acknowledged its process identity.
+    await server.close();
+    if (registration) {
+      await dependencies.waitForGroupExit(registration.pgid!);
+      await dependencies.sendEvent(env, {
+        type: 'process',
+        process: { ...registration, stage: 'drained' },
+      });
+    }
+  }
+}
+
+// Unmanaged invocations keep Playwright's exact original fixtures, including
+// remote connections, test options, and additional browser.newContext() calls.
+export const test =
+  process.env.VONA_TEST_RUN_ID === undefined
+    ? baseTest
+    : baseTest.extend({
+        browser: [
+          async (
+            { playwright, browserName, launchOptions, headless, channel, connectOptions },
+            use,
+          ) => {
+            await useManagedBrowser(
+              {
+                browserType: playwright[browserName],
+                launchOptions,
+                headless,
+                channel,
+                connectOptions,
+              },
+              use,
+            );
+          },
+          { scope: 'worker', timeout: 0 },
+        ],
+      });
+export { expect };

package/repo-e2e/scripts/managedTestImports.test.ts

@@ -0,0 +1,74 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { relative, resolve } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import {
+  assertManagedTestImports,
+  managedTestImportViolations as violations,
+} from './managedTestImports.ts';
+
+const fixturePath = fileURLToPath(new URL('./managedTest.ts', import.meta.url));
+const specRoot = fileURLToPath(new URL('../specs', import.meta.url));
+
+test('all discovered application specs route runtime Playwright imports through the managed fixture', async () => {
+  await assertManagedTestImports();
+});
+
+test('fixture import gate allows type-only imports and catches runtime bypass forms', () => {
+  const spec = resolve(specRoot, 'example.spec.ts');
+  const managed = "import { test, expect } from '../scripts/managedTest.ts';\n";
+  for (const allowed of [
+    "import type { Page } from '@playwright/test';",
+    "import { type Page, type Browser } from '@playwright/test';",
+    "type Response = import('@playwright/test').Response;",
+    "export type { Page } from '@playwright/test';",
+    "export { type Page } from '@playwright/test';",
+  ])
+    assert.deepEqual(violations(managed + allowed, spec), []);
+  for (const bypass of [
+    "import { test } from '@playwright/test';",
+    "import { type Page, expect } from '@playwright/test';",
+    "import * as playwright from '@playwright/test';",
+    "import '@playwright/test';",
+    "export { test } from '@playwright/test';",
+    "export * from '@playwright/test';",
+    "const pw = await import('@playwright/test');",
+    "const pw = require('@playwright/test');",
+    "import pw = require('@playwright/test');",
+    "import { chromium } from 'playwright';",
+    "import { chromium } from 'playwright-core';",
+  ])
+    assert.equal(violations(managed + bypass, spec).length, 1, bypass);
+  assert.deepEqual(violations("import type { test } from '../scripts/managedTest.ts';", spec), [
+    'application spec must import test from managedTest',
+  ]);
+  assert.deepEqual(
+    violations("import { test as appTest } from '../scripts/managedTest.ts';", spec),
+    [],
+  );
+});
+
+test('production gate rejects empty trees, bypasses in nested specs, and symlinks', async () => {
+  const root = await mkdtemp(resolve(tmpdir(), 'cabloy-managed-imports-'));
+  try {
+    await assert.rejects(assertManagedTestImports(root), /no specs/);
+    const nested = resolve(root, 'nested');
+    await mkdir(nested);
+    const spec = resolve(nested, 'application.spec.ts');
+    await writeFile(spec, "import { test } from '@playwright/test';");
+    await assert.rejects(
+      assertManagedTestImports(root),
+      /fixture import violation.*application\.spec\.ts/,
+    );
+    const managedPath = relative(nested, fixturePath).replaceAll('\\', '/');
+    await writeFile(spec, `import { test } from ${JSON.stringify(managedPath)};`);
+    await assertManagedTestImports(root);
+    await symlink(spec, resolve(root, 'linked.spec.ts'));
+    await assert.rejects(assertManagedTestImports(root), /cannot contain symlinks/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});