From cb8c79ac778544cb98dcc549dcfffa7c13ea56fd Mon Sep 17 00:00:00 2001
From: Stefan Andrei <89592870+sneakygriff@users.noreply.github.com>
Date: Sat, 15 Aug 2026 23:32:33 +0300
Subject: [PATCH] fix(test): exempt the live repo tree from hermetic-wiring's
 operator-~/.claude ban
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The skill-seeding tripwire asserted every seeded symlink target must NOT
start with ~/.claude — but on the default global-git install the repo
itself lives at ~/.claude/skills/gstack, so every CORRECT symlink (which
must resolve into the live repo tree, as the very next assertion requires)
carried the banned prefix. The test could never pass on a default install:
pristine v1.64.1.0 (c118e240) fails it in any worktree under
~/.claude/skills/ and passes elsewhere (verified 2026-08-15).

Exempt targets that realpath into the resolved repo ROOT before applying
the operatorClaude ban — realpath both sides so a symlinked HOME can't
dodge the tripwire. Genuine escapes (a target under ~/.claude but outside
the repo) still fail with the escape message.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 test/hermetic-wiring.test.ts | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/test/hermetic-wiring.test.ts b/test/hermetic-wiring.test.ts
index 658344cfe..87fe13523 100644
--- a/test/hermetic-wiring.test.ts
+++ b/test/hermetic-wiring.test.ts
@@ -125,10 +125,21 @@ describe('hermetic wiring tripwire', () => {
     expect(configDir.startsWith(runRoot + path.sep)).toBe(true);
     expect(configDir.startsWith(operatorClaude)).toBe(false);
     const skillsDir = path.join(configDir, 'skills');
+    const repoRootReal = fs.realpathSync(ROOT) + path.sep;
     for (const entry of fs.readdirSync(skillsDir)) {
       const target = fs.readlinkSync(path.join(skillsDir, entry, 'SKILL.md'));
-      expect(target.startsWith(operatorClaude), `${entry}: symlink escapes to ${target}`).toBe(false);
-      expect(fs.realpathSync(target).startsWith(fs.realpathSync(ROOT) + path.sep), `${entry}: symlink outside repo: ${target}`).toBe(true);
+      const resolved = fs.realpathSync(target);
+      // Targets inside the live repo checkout are the blessed edge — exempt
+      // them BEFORE the operator-~/.claude ban. On the default global-git
+      // install the repo itself lives at ~/.claude/skills/gstack, so every
+      // CORRECT symlink carries the operatorClaude prefix and an unexempted
+      // ban can never pass (regression 2026-08-15: pristine v1.64.1.0 fails
+      // this test in any worktree under ~/.claude/skills/ and passes
+      // elsewhere — realpath both sides so a symlinked HOME can't dodge it).
+      if (!resolved.startsWith(repoRootReal)) {
+        expect(resolved.startsWith(operatorClaude), `${entry}: symlink escapes to ${target}`).toBe(false);
+      }
+      expect(resolved.startsWith(repoRootReal), `${entry}: symlink outside repo: ${target}`).toBe(true);
     }
   });
 });