From 23120e34bbdb25f3bd18de15fa5e0e5a3e46ab59 Mon Sep 17 00:00:00 2001 From: euxaristia <25621994+euxaristia@users.noreply.github.com> Date: Fri, 3 Jul 2026 02:37:52 -0400 Subject: [PATCH 1/2] fix(sandbox): gate /tmp test assertions on GOOS, not path existence TestPermissionProfileFromPolicyIncludesDefaultTempWriteRoots and TestNewScopeNormalizesAndValidatesExtraRoots guard their /tmp assertion with pathExists("/tmp"), intending to skip it on Windows. But Go resolves the bare path /tmp against the current drive on Windows, so on any host where C:\tmp exists the guard passes while the product code (correctly, by design - see defaultTempWriteRootCandidatesForGOOS) uses %TEMP%/%TMP% instead, and both tests fail. Gate the assertion on runtime.GOOS != "windows" as well; POSIX behavior is unchanged. Co-Authored-By: Claude Fable 5 --- internal/sandbox/manager_test.go | 3 +++ internal/sandbox/scope_test.go | 3 +++ 2 files changed, 6 insertions(+) diff --git a/internal/sandbox/manager_test.go b/internal/sandbox/manager_test.go index ee93d11e2..5dc754acf 100644 --- a/internal/sandbox/manager_test.go +++ b/internal/sandbox/manager_test.go @@ -72,6 +72,9 @@ func TestPermissionProfileFromPolicyIncludesDefaultTempWriteRoots(t *testing.T) if !writeRootsContain(profile.FileSystem.WriteRoots, tmpdir) { t.Fatalf("write roots = %#v, want temp root %q", profile.FileSystem.WriteRoots, tmpdir) } + // /tmp is a default temp write root on POSIX only (see + // defaultTempWriteRootCandidatesForGOOS); on Windows the bare path resolves + // against the current drive, so a stray C:\tmp must not turn this on. if runtime.GOOS != "windows" && pathExists("/tmp") && !writeRootsContain(profile.FileSystem.WriteRoots, "/tmp") { t.Fatalf("write roots = %#v, want /tmp", profile.FileSystem.WriteRoots) } diff --git a/internal/sandbox/scope_test.go b/internal/sandbox/scope_test.go index 6dc7a146b..3714c75f2 100644 --- a/internal/sandbox/scope_test.go +++ b/internal/sandbox/scope_test.go @@ -129,6 +129,9 @@ func TestNewScopeNormalizesAndValidatesExtraRoots(t *testing.T) { if !stringSliceContains(roots, normalizeWorkspaceRootBestEffort(extra)) { t.Fatalf("Roots()=%v want extra root %q", roots, normalizeWorkspaceRootBestEffort(extra)) } + // /tmp is a default temp write root on POSIX only (see + // defaultTempWriteRootCandidatesForGOOS); on Windows the bare path resolves + // against the current drive, so a stray C:\tmp must not turn this on. if runtime.GOOS != "windows" && pathExists("/tmp") && !stringSliceContains(roots, normalizeWorkspaceRootBestEffort("/tmp")) { t.Fatalf("Roots()=%v want default /tmp write root", roots) } From c16a7cc5e69c3d084e3556fa91cb739be0c851df Mon Sep 17 00:00:00 2001 From: euxaristia <25621994+euxaristia@users.noreply.github.com> Date: Fri, 3 Jul 2026 18:11:04 -0400 Subject: [PATCH 2/2] chore: retrigger CI The Windows smoke job failed on TestLoadOrCreateSecretConcurrentConverges in internal/oauth, unrelated to this change. Retriggering to confirm it was a flake.