saeeol 1.2.4 → 1.2.7

package/test/file/path-traversal.test.ts

@@ -1,205 +0,0 @@
-import { test, expect, describe } from "bun:test"
-import { Effect } from "effect"
-import path from "path"
-import fs from "fs/promises"
-import { Filesystem } from "@/util/filesystem"
-import { File } from "../../src/file"
-import { Instance } from "../../src/project/instance"
-import { containsPath } from "../../src/project/instance-context"
-import { provideInstance, tmpdir } from "../fixture/fixture"
-
-const run = <A, E>(eff: Effect.Effect<A, E, File.Service>) =>
-  Effect.runPromise(provideInstance(Instance.directory)(eff.pipe(Effect.provide(File.defaultLayer))))
-const read = (file: string) => run(File.Service.use((svc) => svc.read(file)))
-const list = (dir?: string) => run(File.Service.use((svc) => svc.list(dir)))
-
-describe("Filesystem.contains", () => {
-  test("allows paths within project", () => {
-    expect(Filesystem.contains("/project", "/project/src")).toBe(true)
-    expect(Filesystem.contains("/project", "/project/src/file.ts")).toBe(true)
-    expect(Filesystem.contains("/project", "/project")).toBe(true)
-  })
-
-  test("blocks ../ traversal", () => {
-    expect(Filesystem.contains("/project", "/project/../etc")).toBe(false)
-    expect(Filesystem.contains("/project", "/project/src/../../etc")).toBe(false)
-    expect(Filesystem.contains("/project", "/etc/passwd")).toBe(false)
-  })
-
-  test("blocks absolute paths outside project", () => {
-    expect(Filesystem.contains("/project", "/etc/passwd")).toBe(false)
-    expect(Filesystem.contains("/project", "/tmp/file")).toBe(false)
-    expect(Filesystem.contains("/home/user/project", "/home/user/other")).toBe(false)
-  })
-
-  test("handles prefix collision edge cases", () => {
-    expect(Filesystem.contains("/project", "/project-other/file")).toBe(false)
-    expect(Filesystem.contains("/project", "/projectfile")).toBe(false)
-  })
-})
-
-/*
- * Integration tests for read() and list() path traversal protection.
- *
- * These tests verify the HTTP API code path is protected. The HTTP endpoints
- * in server.ts (GET /file/content, GET /file) call read()/list()
- * directly - they do NOT go through ReadTool or the agent permission layer.
- *
- * This is a SEPARATE code path from ReadTool, which has its own checks.
- */
-describe("File.read path traversal protection", () => {
-  test("rejects ../ traversal attempting to read /etc/passwd", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "allowed.txt"), "allowed content")
-      },
-    })
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: async () => {
-        await expect(read("../../../etc/passwd")).rejects.toThrow("Access denied: path escapes project directory")
-      },
-    })
-  })
-
-  test("rejects deeply nested traversal", async () => {
-    await using tmp = await tmpdir()
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: async () => {
-        await expect(read("src/nested/../../../../../../../etc/passwd")).rejects.toThrow(
-          "Access denied: path escapes project directory",
-        )
-      },
-    })
-  })
-
-  test("allows valid paths within project", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "valid.txt"), "valid content")
-      },
-    })
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: async () => {
-        const result = await read("valid.txt")
-        expect(result.content).toBe("valid content")
-      },
-    })
-  })
-})
-
-describe("File.list path traversal protection", () => {
-  test("rejects ../ traversal attempting to list /etc", async () => {
-    await using tmp = await tmpdir()
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: async () => {
-        await expect(list("../../../etc")).rejects.toThrow("Access denied: path escapes project directory")
-      },
-    })
-  })
-
-  test("allows valid subdirectory listing", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "subdir", "file.txt"), "content")
-      },
-    })
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: async () => {
-        const result = await list("subdir")
-        expect(Array.isArray(result)).toBe(true)
-      },
-    })
-  })
-})
-
-describe("containsPath", () => {
-  test("returns true for path inside directory", async () => {
-    await using tmp = await tmpdir({ git: true })
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: () => {
-        expect(containsPath(path.join(tmp.path, "foo.txt"), Instance.current)).toBe(true)
-        expect(containsPath(path.join(tmp.path, "src", "file.ts"), Instance.current)).toBe(true)
-      },
-    })
-  })
-
-  test("returns true for path inside worktree but outside directory (monorepo subdirectory scenario)", async () => {
-    await using tmp = await tmpdir({ git: true })
-    const subdir = path.join(tmp.path, "packages", "lib")
-    await fs.mkdir(subdir, { recursive: true })
-
-    await Instance.provide({
-      directory: subdir,
-      fn: () => {
-        // .saeeol at worktree root, but we're running from packages/lib
-        expect(containsPath(path.join(tmp.path, ".saeeol", "state"), Instance.current)).toBe(true)
-        // sibling package should also be accessible
-        expect(containsPath(path.join(tmp.path, "packages", "other", "file.ts"), Instance.current)).toBe(true)
-        // worktree root itself
-        expect(containsPath(tmp.path, Instance.current)).toBe(true)
-      },
-    })
-  })
-
-  test("returns false for path outside both directory and worktree", async () => {
-    await using tmp = await tmpdir({ git: true })
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: () => {
-        expect(containsPath("/etc/passwd", Instance.current)).toBe(false)
-        expect(containsPath("/tmp/other-project", Instance.current)).toBe(false)
-      },
-    })
-  })
-
-  test("returns false for path with .. escaping worktree", async () => {
-    await using tmp = await tmpdir({ git: true })
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: () => {
-        expect(containsPath(path.join(tmp.path, "..", "escape.txt"), Instance.current)).toBe(false)
-      },
-    })
-  })
-
-  test("handles directory === worktree (running from repo root)", async () => {
-    await using tmp = await tmpdir({ git: true })
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: () => {
-        expect(Instance.directory).toBe(Instance.worktree)
-        expect(containsPath(path.join(tmp.path, "file.txt"), Instance.current)).toBe(true)
-        expect(containsPath("/etc/passwd", Instance.current)).toBe(false)
-      },
-    })
-  })
-
-  test("non-git project does not allow arbitrary paths via worktree='/'", async () => {
-    await using tmp = await tmpdir() // no git: true
-
-    await Instance.provide({
-      directory: tmp.path,
-      fn: () => {
-        // worktree is "/" for non-git projects, but containsPath should NOT allow all paths
-        expect(containsPath(path.join(tmp.path, "file.txt"), Instance.current)).toBe(true)
-        expect(containsPath("/etc/passwd", Instance.current)).toBe(false)
-        expect(containsPath("/tmp/other", Instance.current)).toBe(false)
-      },
-    })
-  })
-})

package/test/file/ripgrep.test.ts

@@ -1,226 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import { Effect } from "effect"
-import * as Stream from "effect/Stream"
-import fs from "fs/promises"
-import path from "path"
-import { tmpdir } from "../fixture/fixture"
-import { Ripgrep } from "../../src/file/ripgrep"
-
-const run = <A>(effect: Effect.Effect<A, unknown, Ripgrep.Service>) =>
-  effect.pipe(Effect.provide(Ripgrep.defaultLayer), Effect.runPromise)
-describe.skipIf(process.platform === "win32")("file.ripgrep", () => {
-  test("defaults to include hidden", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "visible.txt"), "hello")
-        await fs.mkdir(path.join(dir, ".saeeol"), { recursive: true })
-        await Bun.write(path.join(dir, ".saeeol", "thing.json"), "{}")
-      },
-    })
-
-    const files = await run(
-      Ripgrep.Service.use((rg) =>
-        rg.files({ cwd: tmp.path }).pipe(
-          Stream.runCollect,
-          Effect.map((c) => [...c]),
-        ),
-      ),
-    )
-    expect(files.includes("visible.txt")).toBe(true)
-    expect(files.includes(path.join(".saeeol", "thing.json"))).toBe(true)
-  })
-
-  test("hidden false excludes hidden", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "visible.txt"), "hello")
-        await fs.mkdir(path.join(dir, ".saeeol"), { recursive: true })
-        await Bun.write(path.join(dir, ".saeeol", "thing.json"), "{}")
-      },
-    })
-
-    const files = await run(
-      Ripgrep.Service.use((rg) =>
-        rg.files({ cwd: tmp.path, hidden: false }).pipe(
-          Stream.runCollect,
-          Effect.map((c) => [...c]),
-        ),
-      ),
-    )
-    expect(files.includes("visible.txt")).toBe(true)
-    expect(files.includes(path.join(".saeeol", "thing.json"))).toBe(false)
-  })
-  test("tree skips .saeeol directory files", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "src", "main.ts"), "export {}")
-        await fs.mkdir(path.join(dir, ".saeeol"), { recursive: true })
-        await Bun.write(path.join(dir, ".saeeol", "config.json"), "{}")
-      },
-    })
-
-    const result = await run(Ripgrep.Service.use((rg) => rg.tree({ cwd: tmp.path })))
-    expect(result).not.toContain(".saeeol")
-    expect(result).toContain("src")
-  })
-
-  test("search returns empty when nothing matches", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "match.ts"), "const value = 'other'\n")
-      },
-    })
-
-    const result = await run(Ripgrep.Service.use((rg) => rg.search({ cwd: tmp.path, pattern: "needle" })))
-    expect(result.partial).toBe(false)
-    expect(result.items).toEqual([])
-  })
-
-  test("search returns match metadata with normalized path", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await fs.mkdir(path.join(dir, "src"), { recursive: true })
-        await Bun.write(path.join(dir, "src", "match.ts"), "const needle = 1\n")
-      },
-    })
-
-    const result = await run(Ripgrep.Service.use((rg) => rg.search({ cwd: tmp.path, pattern: "needle" })))
-    expect(result.partial).toBe(false)
-    expect(result.items).toHaveLength(1)
-    expect(result.items[0]?.path.text).toBe(path.join("src", "match.ts"))
-    expect(result.items[0]?.line_number).toBe(1)
-    expect(result.items[0]?.lines.text).toContain("needle")
-  })
-
-  test("search returns matched rows with glob filter", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "match.ts"), "const value = 'needle'\n")
-        await Bun.write(path.join(dir, "skip.txt"), "const value = 'other'\n")
-      },
-    })
-
-    const result = await run(
-      Ripgrep.Service.use((rg) => rg.search({ cwd: tmp.path, pattern: "needle", glob: ["*.ts"] })),
-    )
-    expect(result.partial).toBe(false)
-    expect(result.items).toHaveLength(1)
-    expect(result.items[0]?.path.text).toContain("match.ts")
-    expect(result.items[0]?.lines.text).toContain("needle")
-  })
-
-  test("search supports explicit file targets", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "match.ts"), "const value = 'needle'\n")
-        await Bun.write(path.join(dir, "skip.ts"), "const value = 'needle'\n")
-      },
-    })
-
-    const file = path.join(tmp.path, "match.ts")
-    const result = await run(Ripgrep.Service.use((rg) => rg.search({ cwd: tmp.path, pattern: "needle", file: [file] })))
-    expect(result.partial).toBe(false)
-    expect(result.items).toHaveLength(1)
-    expect(result.items[0]?.path.text).toBe(file)
-  })
-
-  test("files returns empty when glob matches no files", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await fs.mkdir(path.join(dir, "packages", "console"), { recursive: true })
-        await Bun.write(path.join(dir, "packages", "console", "package.json"), "{}")
-      },
-    })
-
-    const files = await run(
-      Ripgrep.Service.use((rg) =>
-        rg.files({ cwd: tmp.path, glob: ["packages/*"] }).pipe(
-          Stream.runCollect,
-          Effect.map((c) => [...c]),
-        ),
-      ),
-    )
-    expect(files).toEqual([])
-  })
-
-  test("files returns stream of filenames", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "a.txt"), "hello")
-        await Bun.write(path.join(dir, "b.txt"), "world")
-      },
-    })
-
-    const files = await run(
-      Ripgrep.Service.use((rg) =>
-        rg.files({ cwd: tmp.path }).pipe(
-          Stream.runCollect,
-          Effect.map((c) => [...c].sort()),
-        ),
-      ),
-    )
-    expect(files).toEqual(["a.txt", "b.txt"])
-  })
-
-  test("files respects glob filter", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "keep.ts"), "yes")
-        await Bun.write(path.join(dir, "skip.txt"), "no")
-      },
-    })
-
-    const files = await run(
-      Ripgrep.Service.use((rg) =>
-        rg.files({ cwd: tmp.path, glob: ["*.ts"] }).pipe(
-          Stream.runCollect,
-          Effect.map((c) => [...c]),
-        ),
-      ),
-    )
-    expect(files).toEqual(["keep.ts"])
-  })
-
-  test("files dies on nonexistent directory", async () => {
-    const exit = await Ripgrep.Service.use((rg) =>
-      rg.files({ cwd: "/tmp/nonexistent-dir-12345" }).pipe(Stream.runCollect),
-    ).pipe(Effect.provide(Ripgrep.defaultLayer), Effect.runPromiseExit)
-    expect(exit._tag).toBe("Failure")
-  })
-
-  test("ignores RIPGREP_CONFIG_PATH in direct mode", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "match.ts"), "const needle = 1\n")
-      },
-    })
-
-    const prev = process.env["RIPGREP_CONFIG_PATH"]
-    process.env["RIPGREP_CONFIG_PATH"] = path.join(tmp.path, "missing-ripgreprc")
-    try {
-      const result = await run(Ripgrep.Service.use((rg) => rg.search({ cwd: tmp.path, pattern: "needle" })))
-      expect(result.items).toHaveLength(1)
-    } finally {
-      if (prev === undefined) delete process.env["RIPGREP_CONFIG_PATH"]
-      else process.env["RIPGREP_CONFIG_PATH"] = prev
-    }
-  })
-
-  test("ignores RIPGREP_CONFIG_PATH in worker mode", async () => {
-    await using tmp = await tmpdir({
-      init: async (dir) => {
-        await Bun.write(path.join(dir, "match.ts"), "const needle = 1\n")
-      },
-    })
-
-    const prev = process.env["RIPGREP_CONFIG_PATH"]
-    process.env["RIPGREP_CONFIG_PATH"] = path.join(tmp.path, "missing-ripgreprc")
-    try {
-      const result = await run(Ripgrep.Service.use((rg) => rg.search({ cwd: tmp.path, pattern: "needle" })))
-      expect(result.items).toHaveLength(1)
-    } finally {
-      if (prev === undefined) delete process.env["RIPGREP_CONFIG_PATH"]
-      else process.env["RIPGREP_CONFIG_PATH"] = prev
-    }
-  })
-})

package/test/file/watcher.test.ts

@@ -1,249 +0,0 @@
-import { $ } from "bun"
-import { afterEach, describe, expect, test } from "bun:test"
-import fs from "fs/promises"
-import path from "path"
-import { ConfigProvider, Deferred, Effect, Layer, ManagedRuntime, Option } from "effect"
-import { disposeAllInstances, tmpdir } from "../fixture/fixture"
-import { Bus } from "../../src/bus"
-import { Config } from "@/config/config"
-import { FileWatcher } from "../../src/file/watcher"
-import { Git } from "../../src/git"
-import { Instance } from "../../src/project/instance"
-
-// Native @parcel/watcher bindings aren't reliably available in CI (missing on Linux, flaky on Windows)
-const describeWatcher = FileWatcher.hasNativeBinding() && !process.env.CI ? describe : describe.skip
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-const watcherConfigLayer = ConfigProvider.layer(
-  ConfigProvider.fromUnknown({
-    SAEEOL_EXPERIMENTAL_FILEWATCHER: "true",
-    SAEEOL_EXPERIMENTAL_DISABLE_FILEWATCHER: "false",
-  }),
-)
-
-type WatcherEvent = { file: string; event: "add" | "change" | "unlink" }
-
-/** Run `body` with a live FileWatcher service. */
-function withWatcher<E>(directory: string, body: Effect.Effect<void, E>) {
-  return Instance.provide({
-    directory,
-    fn: async () => {
-      const layer: Layer.Layer<FileWatcher.Service, never, never> = FileWatcher.layer.pipe(
-        Layer.provide(Config.defaultLayer),
-        Layer.provide(Git.defaultLayer),
-        Layer.provide(watcherConfigLayer),
-      )
-      const rt = ManagedRuntime.make(layer)
-      try {
-        await rt.runPromise(FileWatcher.Service.use((s) => s.init()))
-        await Effect.runPromise(ready(directory))
-        await Effect.runPromise(body)
-      } finally {
-        await rt.dispose()
-      }
-    },
-  })
-}
-
-function listen(directory: string, check: (evt: WatcherEvent) => boolean, hit: (evt: WatcherEvent) => void) {
-  let done = false
-
-  const unsub = Bus.subscribe(FileWatcher.Event.Updated, (evt) => {
-    if (done) return
-    if (!check(evt.properties)) return
-    hit(evt.properties)
-  })
-
-  return () => {
-    if (done) return
-    done = true
-    unsub()
-  }
-}
-
-function wait(directory: string, check: (evt: WatcherEvent) => boolean) {
-  return Effect.gen(function* () {
-    const deferred = yield* Deferred.make<WatcherEvent>()
-    const cleanup = yield* Effect.sync(() => {
-      let off = () => {}
-      off = listen(directory, check, (evt) => {
-        off()
-        Deferred.doneUnsafe(deferred, Effect.succeed(evt))
-      })
-      return off
-    })
-    return { cleanup, deferred }
-  })
-}
-
-function nextUpdate<E>(directory: string, check: (evt: WatcherEvent) => boolean, trigger: Effect.Effect<void, E>) {
-  return Effect.acquireUseRelease(
-    wait(directory, check),
-    ({ deferred }) =>
-      Effect.gen(function* () {
-        yield* trigger
-        return yield* Deferred.await(deferred).pipe(Effect.timeout("5 seconds"))
-      }),
-    ({ cleanup }) => Effect.sync(cleanup),
-  )
-}
-
-/** Effect that asserts no matching event arrives within `ms`. */
-function noUpdate<E>(
-  directory: string,
-  check: (evt: WatcherEvent) => boolean,
-  trigger: Effect.Effect<void, E>,
-  ms = 500,
-) {
-  return Effect.acquireUseRelease(
-    wait(directory, check),
-    ({ deferred }) =>
-      Effect.gen(function* () {
-        yield* trigger
-        expect(yield* Deferred.await(deferred).pipe(Effect.timeoutOption(`${ms} millis`))).toEqual(Option.none())
-      }),
-    ({ cleanup }) => Effect.sync(cleanup),
-  )
-}
-
-function ready(directory: string) {
-  const file = path.join(directory, `.watcher-${Math.random().toString(36).slice(2)}`)
-  const head = path.join(directory, ".git", "HEAD")
-
-  return Effect.gen(function* () {
-    yield* nextUpdate(
-      directory,
-      (evt) => evt.file === file && evt.event === "add",
-      Effect.promise(() => fs.writeFile(file, "ready")),
-    ).pipe(Effect.ensuring(Effect.promise(() => fs.rm(file, { force: true }).catch(() => undefined))), Effect.asVoid)
-
-    const git = yield* Effect.promise(() =>
-      fs
-        .stat(head)
-        .then(() => true)
-        .catch(() => false),
-    )
-    if (!git) return
-
-    const branch = `watch-${Math.random().toString(36).slice(2)}`
-    const hash = yield* Effect.promise(() => $`git rev-parse HEAD`.cwd(directory).quiet().text())
-    yield* nextUpdate(
-      directory,
-      (evt) => evt.file === head && evt.event !== "unlink",
-      Effect.promise(async () => {
-        await fs.writeFile(path.join(directory, ".git", "refs", "heads", branch), hash.trim() + "\n")
-        await fs.writeFile(head, `ref: refs/heads/${branch}\n`)
-      }),
-    ).pipe(Effect.asVoid)
-  })
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describeWatcher("FileWatcher", () => {
-  afterEach(async () => {
-    await disposeAllInstances()
-  })
-
-  test("publishes root create, update, and delete events", async () => {
-    await using tmp = await tmpdir({ git: true })
-    const file = path.join(tmp.path, "watch.txt")
-    const dir = tmp.path
-    const cases = [
-      { event: "add" as const, trigger: Effect.promise(() => fs.writeFile(file, "a")) },
-      { event: "change" as const, trigger: Effect.promise(() => fs.writeFile(file, "b")) },
-      { event: "unlink" as const, trigger: Effect.promise(() => fs.unlink(file)) },
-    ]
-
-    await withWatcher(
-      dir,
-      Effect.forEach(cases, ({ event, trigger }) =>
-        nextUpdate(dir, (evt) => evt.file === file && evt.event === event, trigger).pipe(
-          Effect.tap((evt) => Effect.sync(() => expect(evt).toEqual({ file, event }))),
-        ),
-      ),
-    )
-  })
-
-  test("watches non-git roots", async () => {
-    await using tmp = await tmpdir()
-    const file = path.join(tmp.path, "plain.txt")
-    const dir = tmp.path
-
-    await withWatcher(
-      dir,
-      nextUpdate(
-        dir,
-        (e) => e.file === file && e.event === "add",
-        Effect.promise(() => fs.writeFile(file, "plain")),
-      ).pipe(Effect.tap((evt) => Effect.sync(() => expect(evt).toEqual({ file, event: "add" })))),
-    )
-  })
-
-  test("cleanup stops publishing events", async () => {
-    await using tmp = await tmpdir({ git: true })
-    const file = path.join(tmp.path, "after-dispose.txt")
-
-    // Start and immediately stop the watcher (withWatcher disposes on exit)
-    await withWatcher(tmp.path, Effect.void)
-
-    // Now write a file — no watcher should be listening
-    await Instance.provide({
-      directory: tmp.path,
-      fn: () =>
-        Effect.runPromise(
-          noUpdate(
-            tmp.path,
-            (e) => e.file === file,
-            Effect.promise(() => fs.writeFile(file, "gone")),
-          ),
-        ),
-    })
-  })
-
-  test("ignores .git/index changes", async () => {
-    await using tmp = await tmpdir({ git: true })
-    const gitIndex = path.join(tmp.path, ".git", "index")
-    const edit = path.join(tmp.path, "tracked.txt")
-
-    await withWatcher(
-      tmp.path,
-      noUpdate(
-        tmp.path,
-        (e) => e.file === gitIndex,
-        Effect.promise(async () => {
-          await fs.writeFile(edit, "a")
-          await $`git add .`.cwd(tmp.path).quiet().nothrow()
-        }),
-      ),
-    )
-  })
-
-  test("publishes .git/HEAD events", async () => {
-    await using tmp = await tmpdir({ git: true })
-    const head = path.join(tmp.path, ".git", "HEAD")
-    const branch = `watch-${Math.random().toString(36).slice(2)}`
-    await $`git branch ${branch}`.cwd(tmp.path).quiet()
-
-    await withWatcher(
-      tmp.path,
-      nextUpdate(
-        tmp.path,
-        (evt) => evt.file === head && evt.event !== "unlink",
-        Effect.promise(() => fs.writeFile(head, `ref: refs/heads/${branch}\n`)),
-      ).pipe(
-        Effect.tap((evt) =>
-          Effect.sync(() => {
-            expect(evt.file).toBe(head)
-            expect(["add", "change"]).toContain(evt.event)
-          }),
-        ),
-      ),
-    )
-  })
-})