gstack/browse/test/dia-macos-qualification.test.ts

import { afterAll, describe, expect, spyOn, test } from 'bun:test';
import { createRequire } from 'node:module';
import { spawnSync } from 'node:child_process';
import { appendFileSync, chmodSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import path from 'node:path';
import { pathToFileURL } from 'node:url';
import { Database } from 'bun:sqlite';
import {
  allowedFixturePage, assertDiaSocketPath, assertOwnedDiaProfile, browserCleanupError, browserGroupFacts, browserOperationTimedOut, browserPreflightError, browserRootFacts,
  browserStartupCategory, browserStartupFacts, browserStderrFacts, browserStderrReasons, captureUserKeychains, classifyNativeWaitSample, createBrowserStderrCapture, createOwnedDiaProfile, DIA_DOWNLOAD, fixtureKeychainRestoreCommands,
  hasSandboxDisablingArgument, inspectMachOArchitectures, joinOwnedBrowserClose, macosCompatibility, nativeDiaLaunchOptions, observeBrowserLaunches,
  observePendingBrowserLaunch, sampleOwnedDiaWait, stopOwnedBrowserGroup,
  observeDiaKeychainEnvironments, observeFixtureKeychain, parseDefaultKeychain, parseKeychainPaths, playwrightModuleLoadFacts, prepareKeychainHome,
  qualifyDia, readFreshAccountConfiguration, removeOwnedDiaProfile, validateQualificationHost, writePrivateReceipt,
} from '../../.github/scripts/qualify-dia-macos';
import { ARCHIVE_CHECK, FRESH_WORK_PREFIX, PRIVATE_RECEIPT_READ, classifyParentDomain, classifyUserDomain, freshLaunchDefinition, freshQualificationPassed,
  inspectParentDomain, inspectUidProcesses, inspectUserDomain,
  ownedUserDomainTarget, ownsFreshAccount, ownsLaunchService, parseDirectoryIds, parseDirectoryRecord, passiveUserDomainState,
  runFreshAccountQualification, uidProcessFacts } from '../../.github/scripts/run-dia-native-qualification';

const require = createRequire(import.meta.url);
const root = mkdtempSync(path.join(tmpdir(), 'dia-qualification-test-'));
const script = path.resolve(import.meta.dir, '../../.github/scripts/qualify-dia-macos.ts');
const nativeEnvironment = {
  CI: 'true', GITHUB_ACTIONS: 'true', RUNNER_ENVIRONMENT: 'github-hosted', RUNNER_OS: 'macOS', RUNNER_ARCH: 'ARM64',
  GSTACK_DIA_NATIVE_QUALIFY: '1', RUNNER_TEMP: root, GITHUB_RUN_ID: 'fixture-run', GITHUB_RUN_ATTEMPT: '1',
};

afterAll(() => rmSync(root, { recursive: true, force: true }));

describe('Dia macOS CI qualification safety', () => {
  test('admission accepts only the explicitly enabled disposable ARM64 Mac combination', () => {
    expect(() => validateQualificationHost(nativeEnvironment, 'darwin', 'arm64')).not.toThrow();
    for (const [platform, architecture] of [['linux', 'arm64'], ['win32', 'arm64'], ['darwin', 'x64']]) {
      expect(() => validateQualificationHost(nativeEnvironment, platform as any, architecture as any)).toThrow('disposable_arm64_macos_ci_required');
    }
    expect(readdirSync(root)).toEqual([]);
  });

  for (const name of Object.keys(nativeEnvironment)) {
    test(`requires admission field ${name} before any native work`, () => {
      const env: NodeJS.ProcessEnv = { ...nativeEnvironment };
      delete env[name];
      expect(() => validateQualificationHost(env, 'darwin', 'arm64')).toThrow('disposable_arm64_macos_ci_required');
      expect(readdirSync(root)).toEqual([]);
    });
  }

  test('rejects a self-hosted machine even when the OS and opt-in match', () => {
    expect(() => validateQualificationHost({ ...nativeEnvironment, RUNNER_ENVIRONMENT: 'self-hosted' }, 'darwin', 'arm64'))
      .toThrow('disposable_arm64_macos_ci_required');
  });

  test('the actual launcher refuses an unapproved environment without staging files', () => {
    const nativeTemp = mkdtempSync(path.join(root, 'runner-temp-'));
    const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros', `--config=${process.platform === 'win32' ? 'NUL' : '/dev/null'}`, script], {
      cwd: root, env: { PATH: path.dirname(process.execPath), HOME: root, RUNNER_TEMP: nativeTemp,
        ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}) },
      encoding: 'utf8', timeout: 10_000,
    });
    expect(result.status).toBe(2);
    expect(result.stderr).toBe('');
    expect(JSON.parse(result.stdout)).toEqual({ status: 'incomplete', reason: 'qualification_preflight_failed', counts: { pass: 0, fail: 0, skip: 0 } });
    expect(readdirSync(nativeTemp)).toEqual([]);
  });

  test('a fresh fixture-HOME child uses unmodified production Dia profile and domain discovery', () => {
    const home = realpathSync(mkdtempSync(path.join(root, 'fixture-home-')));
    const ownership = createOwnedDiaProfile(home);
    const profile = path.join(ownership.profile, 'Default');
    mkdirSync(profile, { recursive: true });
    const database = new Database(path.join(profile, 'Cookies'));
    database.run('CREATE TABLE cookies (host_key TEXT, has_expires INTEGER, expires_utc INTEGER)');
    database.query('INSERT INTO cookies VALUES (?, ?, ?)').run('.fixture.test', 0, 0);
    database.close();
    const production = pathToFileURL(path.resolve(import.meta.dir, '../src/cookie-import-browser.ts')).href;
    const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros', `--config=${process.platform === 'win32' ? 'NUL' : '/dev/null'}`, '-e', `
      import { homedir } from 'node:os';
      const { listProfiles, listDomains } = await import(${JSON.stringify(production)});
      console.log(JSON.stringify({ homeAtStartup: homedir() === process.env.HOME,
        profiles: listProfiles('Dia').map(profile => profile.name), domains: listDomains('Dia', 'Default').domains }));
    `], {
      cwd: root, env: { PATH: path.dirname(process.execPath), HOME: home, USERPROFILE: home,
        ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}) },
      encoding: 'utf8', timeout: 10_000,
    });
    expect(result.status).toBe(0);
    expect(result.stderr).toBe('');
    expect(JSON.parse(result.stdout)).toEqual({ homeAtStartup: true, profiles: ['Default'], domains: [{ domain: '.fixture.test', count: 1 }] });
    expect(() => assertOwnedDiaProfile(ownership)).not.toThrow();
    removeOwnedDiaProfile(ownership, true);
    expect(existsSync(home)).toBe(true);
  });

  for (const precreate of [false, true]) {
    test(`late-installed real Playwright loads only with its dependency directory present at startup (${precreate})`, () => {
      const fixture = realpathSync(mkdtempSync(path.join(root, 'late-playwright-')));
      const home = path.join(fixture, 'home');
      const scripts = path.join(fixture, '.github/scripts');
      const modules = path.join(fixture, 'node_modules');
      mkdirSync(home);
      mkdirSync(scripts, { recursive: true });
      if (precreate) mkdirSync(modules, { mode: 0o700 });
      writeFileSync(path.join(fixture, 'package.json'), JSON.stringify({ type: 'module', dependencies: { playwright: '1.62.1' } }));
      const sourceModules = path.resolve(import.meta.dir, '../../node_modules');
      const worker = path.join(scripts, 'worker.ts');
      writeFileSync(worker, `
        import { cpSync, mkdirSync } from 'node:fs';
        import { createRequire } from 'node:module';
        const require = createRequire(import.meta.url);
        mkdirSync(${JSON.stringify(modules)}, { recursive: true });
        for (const name of ['playwright', 'playwright-core']) cpSync(${JSON.stringify(sourceModules)} + '/' + name, ${JSON.stringify(modules)} + '/' + name, { recursive: true });
        const version = require(${JSON.stringify(path.join(modules, 'playwright/package.json'))}).version;
        try {
          const loaded = await import('playwright');
          console.log(JSON.stringify({ version, loaded: !!loaded.chromium }));
        } catch (error) {
          console.log(JSON.stringify({ version, type: error.name, code: error.code }));
          process.exitCode = 2;
        }
      `);
      const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros',
        `--config=${process.platform === 'win32' ? 'NUL' : '/dev/null'}`, worker], {
        cwd: fixture, env: { HOME: home, PATH: path.dirname(process.execPath) }, encoding: 'utf8', timeout: 30_000,
      });
      expect(result.stderr).toBe('');
      expect(result.status).toBe(precreate ? 0 : 2);
      expect(JSON.parse(result.stdout)).toEqual(precreate ? { version: '1.62.1', loaded: true }
        : { version: '1.62.1', type: 'ResolveMessage', code: 'ERR_MODULE_NOT_FOUND' });
    });
  }

  test('the download is the published HTTPS Dia release endpoint', () => {
    expect(DIA_DOWNLOAD).toBe('https://releases.diabrowser.com/release/Dia-latest.dmg');
  });

  describe('bounded Mach-O architecture inspection', () => {
    const thin = (cpu = 0x0100000c, subtype = 0, little = true, wide = true) => {
      const buffer = Buffer.alloc((wide ? 32 : 28) + 8);
      const word = (value: number, at: number) => little ? buffer.writeUInt32LE(value, at) : buffer.writeUInt32BE(value, at);
      word(wide ? 0xfeedfacf : 0xfeedface, 0);
      word(cpu, 4);
      word(subtype, 8);
      word(2, 12);
      word(1, 16);
      word(8, 20);
      return buffer;
    };
    const fat = (little = false, wide = false) => {
      const buffer = Buffer.alloc(512);
      const word = (value: number, at: number) => little ? buffer.writeUInt32LE(value, at) : buffer.writeUInt32BE(value, at);
      const wideWord = (value: bigint, at: number) => little ? buffer.writeBigUInt64LE(value, at) : buffer.writeBigUInt64BE(value, at);
      word(wide ? 0xcafebabf : 0xcafebabe, 0);
      word(2, 4);
      for (const [index, cpu, subtype] of [[0, 0x01000007, 3], [1, 0x0100000c, 0]]) {
        const at = 8 + index * (wide ? 32 : 20);
        const image = thin(cpu, subtype);
        word(cpu, at);
        word(subtype, at + 4);
        if (wide) { wideWord(BigInt(128 * (index + 1)), at + 8); wideWord(BigInt(image.length), at + 16); }
        else { word(128 * (index + 1), at + 8); word(image.length, at + 12); }
        word(7, at + (wide ? 24 : 16));
        image.copy(buffer, 128 * (index + 1));
      }
      return buffer;
    };
    const store = (buffer: Buffer) => {
      const directory = realpathSync(mkdtempSync(path.join(root, 'macho-')));
      const file = path.join(directory, 'executable');
      writeFileSync(file, buffer, { mode: 0o600 });
      return file;
    };
    for (const little of [true, false]) {
      test(`thin headers honor byte order (${little}) and distinguish arm64 subtypes`, () => {
        expect(inspectMachOArchitectures(store(thin(0x0100000c, 0, little))).architectures).toEqual(['arm64']);
        expect(inspectMachOArchitectures(store(thin(0x0100000c, 0x80000002, little))).architectures).toEqual(['arm64e']);
        expect(inspectMachOArchitectures(store(thin(0x01000007, 3, little))).architectures).toEqual(['x86_64']);
        expect(inspectMachOArchitectures(store(thin(7, 3, little, false))).architectures).toEqual(['i386']);
      });
      for (const wide of [true, false]) {
        test(`fat headers verify their actual slices (${little}, ${wide})`, () => {
          const result = inspectMachOArchitectures(store(fat(little, wide)));
          expect(result).toMatchObject({ method: 'bounded_macho_headers', format: wide ? 'fat64' : 'fat32', slices: 2,
            architectures: ['x86_64', 'arm64'] });
          expect(result.bytesRead).toBeLessThanOrEqual(4096);
        });
      }
    }

    for (const invalid of ['magic', 'truncated', 'empty_fat', 'excessive_fat', 'truncated_table', 'table_overlap', 'slice_overlap',
      'slice_out_of_bounds', 'slice_too_short', 'misaligned', 'alignment_overflow', 'cpu_mismatch', 'subtype_mismatch', 'nested_fat',
      'duplicate_architecture', 'wide_offset_overflow', 'reserved', 'header_width', 'file_type', 'load_commands', 'unknown_cpu']) {
      test(`architecture inspection rejects ${invalid} rather than guessing arm64`, () => {
        let image = fat();
        if (invalid === 'magic') image = Buffer.from('not a macho executable');
        if (invalid === 'truncated') image = thin().subarray(0, 20);
        if (invalid === 'empty_fat') image.writeUInt32BE(0, 4);
        if (invalid === 'excessive_fat') image.writeUInt32BE(33, 4);
        if (invalid === 'truncated_table') image = image.subarray(0, 24);
        if (invalid === 'table_overlap') image.writeUInt32BE(0, 16);
        if (invalid === 'slice_overlap') image.writeUInt32BE(128, 36);
        if (invalid === 'slice_out_of_bounds') image.writeUInt32BE(1024, 36);
        if (invalid === 'slice_too_short') image.writeUInt32BE(28, 40);
        if (invalid === 'misaligned') image.writeUInt32BE(257, 36);
        if (invalid === 'alignment_overflow') image.writeUInt32BE(0xffffffff, 44);
        if (invalid === 'cpu_mismatch') image.writeUInt32LE(0x01000007, 260);
        if (invalid === 'subtype_mismatch') image.writeUInt32LE(2, 264);
        if (invalid === 'nested_fat') image.writeUInt32BE(0xcafebabe, 256);
        if (invalid === 'duplicate_architecture') { image.writeUInt32BE(0x01000007, 28); image.writeUInt32BE(3, 32); thin(0x01000007, 3).copy(image, 256); }
        if (invalid === 'wide_offset_overflow') { image = fat(false, true); image.writeBigUInt64BE(1n << 60n, 16); }
        if (invalid === 'reserved') { image = fat(false, true); image.writeUInt32BE(1, 36); }
        if (invalid === 'header_width') image = thin(0x0100000c, 0, true, false);
        if (invalid === 'file_type') { image = thin(); image.writeUInt32LE(6, 12); }
        if (invalid === 'load_commands') { image = thin(); image.writeUInt32LE(1000, 20); }
        if (invalid === 'unknown_cpu') image = thin(0x010000ff, 0);
        expect(() => inspectMachOArchitectures(store(image))).toThrow();
      });
    }

    test('architecture inspection rejects links, non-files, and expired budgets', () => {
      const file = store(thin());
      symlinkSync(file, file + '.link');
      expect(() => inspectMachOArchitectures(file + '.link')).toThrow('unsafe_macho_file');
      expect(() => inspectMachOArchitectures(path.dirname(file))).toThrow('unsafe_macho_file');
      for (const budget of [0, NaN, Infinity]) expect(() => inspectMachOArchitectures(file, budget)).toThrow('macho_read_budget_exhausted');
      expect(qualifyDia.toString()).not.toContain('/usr/bin/lipo');
    });

    for (const change of ['append', 'replace']) {
      test(`architecture inspection detects a file that changes by ${change}`, () => {
        const image = thin();
        const file = store(image);
        let ticks = 0;
        const clock = spyOn(performance, 'now').mockImplementation(() => {
          if (++ticks === 3) {
            if (change === 'append') appendFileSync(file, Buffer.from([0]));
            else { renameSync(file, file + '.previous'); writeFileSync(file, image); }
          }
          return 100;
        });
        try { expect(() => inspectMachOArchitectures(file)).toThrow('macho_changed_during_inspection'); }
        finally { clock.mockRestore(); }
      });
    }
  });
  test('the exact nested macOS account and qualifier socket layout stays below the unchanged limit', () => {
    const sourceProfile = path.posix.join(FRESH_WORK_PREFIX + 'XXXXXX', 'tmp', 'dia-XXXXXX', 'h', 'Library/Application Support/Dia/User Data');
    expect(Buffer.byteLength(sourceProfile + '/SingletonSocket')).toBe(97);
    expect(() => assertDiaSocketPath(sourceProfile)).not.toThrow();
    const oldProfile = '/private/tmp/dia-native-XXXXXX/tmp/dia-XXXXXX/h/Library/Application Support/Dia/User Data';
    expect(Buffer.byteLength(oldProfile + '/SingletonSocket')).toBe(105);
    expect(() => assertDiaSocketPath(oldProfile)).toThrow('fixture_socket_path_too_long');
    const atLimit = '/' + 'x'.repeat(100 - Buffer.byteLength('//SingletonSocket'));
    expect(Buffer.byteLength(atLimit + '/SingletonSocket')).toBe(100);
    expect(() => assertDiaSocketPath(atLimit)).toThrow('fixture_socket_path_too_long');
  });

  test('the registered-home source profile fits the socket bound without a shadow HOME', () => {
    const profile = path.posix.join(FRESH_WORK_PREFIX + 'XXXXXX', 'home', 'Library/Application Support/Dia/User Data');
    expect(Buffer.byteLength(profile + '/SingletonSocket')).toBe(85);
    expect(() => assertDiaSocketPath(profile)).not.toThrow();
    const implementation = qualifyDia.toString();
    expect(implementation).toContain('readFreshAccountConfiguration');
    expect(implementation).toContain('const home = account.home');
    expect(implementation).not.toMatch(/fixtureEnvironment|systemEnvironment|isolation\.originalHome/);
    expect(implementation).toContain('removeOwnedDiaProfile');
  });

  test('profile ownership is exclusive and cleanup preserves the account home and sibling state', () => {
    const home = realpathSync(mkdtempSync(path.join(root, 'owned-profile-home-')));
    prepareKeychainHome(home);
    const preserved = path.join(home, 'Library/Keychains/fixture-state');
    writeFileSync(preserved, 'preserved fixture state');
    const ownership = createOwnedDiaProfile(home);
    const sibling = path.join(path.dirname(ownership.profile), 'sibling-state');
    writeFileSync(sibling, 'preserved sibling state');
    expect(() => assertOwnedDiaProfile(ownership)).not.toThrow();
    expect(() => createOwnedDiaProfile(home)).toThrow();
    expect(() => removeOwnedDiaProfile(ownership, false)).toThrow('owned_browsers_not_stopped');
    expect(existsSync(ownership.profile)).toBe(true);
    removeOwnedDiaProfile(ownership, true);
    expect(existsSync(ownership.profile)).toBe(false);
    expect(existsSync(home)).toBe(true);
    expect(readFileSync(preserved, 'utf8')).toBe('preserved fixture state');
    expect(readFileSync(sibling, 'utf8')).toBe('preserved sibling state');
  });

  for (const change of ['nonce', 'inode', 'marker_symlink', 'profile_symlink', 'uid', 'home_escape', 'marker_permissions', 'marker_hardlink']) {
    test(`profile cleanup refuses changed ${change} ownership without deleting the directory`, () => {
      const home = realpathSync(mkdtempSync(path.join(root, 'profile-refusal-')));
      const ownership = createOwnedDiaProfile(home);
      const profile = ownership.profile;
      const marker = path.join(profile, '.gstack-dia-owner');
      if (change === 'nonce') writeFileSync(marker, (ownership.nonce[0] === '0' ? '1' : '0') + ownership.nonce.slice(1));
      if (change === 'inode') {
        renameSync(profile, profile + '.original');
        mkdirSync(profile, { mode: 0o700 });
        writeFileSync(marker, ownership.nonce, { mode: 0o600 });
      }
      if (change === 'marker_symlink') { renameSync(marker, marker + '.original'); symlinkSync(marker + '.original', marker); }
      if (change === 'profile_symlink') { renameSync(profile, profile + '.original'); symlinkSync(profile + '.original', profile, 'dir'); }
      if (change === 'uid') ownership.uid = process.getuid!() + 1;
      if (change === 'home_escape') ownership.profile = home;
      if (change === 'marker_permissions') chmodSync(marker, 0o644);
      if (change === 'marker_hardlink') linkSync(marker, path.join(home, 'marker-link'));
      expect(() => removeOwnedDiaProfile(ownership, true)).toThrow();
      expect(existsSync(profile)).toBe(true);
      expect(existsSync(home)).toBe(true);
    });
  }

  test('source profile creation refuses existing profiles and linked ancestors without writing through them', () => {
    const home = realpathSync(mkdtempSync(path.join(root, 'existing-profile-')));
    const profile = path.join(home, 'Library/Application Support/Dia/User Data');
    mkdirSync(profile, { recursive: true });
    writeFileSync(path.join(profile, 'existing-state'), 'untouched');
    expect(() => createOwnedDiaProfile(home)).toThrow();
    expect(readdirSync(profile)).toEqual(['existing-state']);
    const linkedHome = realpathSync(mkdtempSync(path.join(root, 'linked-profile-home-')));
    const elsewhere = realpathSync(mkdtempSync(path.join(root, 'linked-profile-target-')));
    symlinkSync(elsewhere, path.join(linkedHome, 'Library'), 'dir');
    expect(() => createOwnedDiaProfile(linkedHome)).toThrow('unsafe_profile_ancestor');
    expect(readdirSync(elsewhere)).toEqual([]);
  });

  test('the qualifier rejects an arbitrary caller-supplied home as fresh account authority', () => {
    const fake = path.join(root, 'account.json');
    writeFileSync(fake, JSON.stringify({ home: root, uid: process.getuid?.() }));
    expect(() => readFreshAccountConfiguration(fake)).toThrow('unsafe_fresh_account_configuration');
    expect(() => readFreshAccountConfiguration('account.json')).toThrow('unsafe_fresh_account_configuration');
  });

  test('headless source launch removes mock Keychain and first-run suppression defaults', () => {
    const env = { HOME: '/fixture/home', PATH: '/usr/bin:/bin' };
    const options = nativeDiaLaunchOptions('/fixture/Dia.app/Contents/MacOS/Dia', env);
    expect(options.headless).toBe(true);
    expect(options.chromiumSandbox).toBe(true);
    expect(options.timeout).toBe(30_000);
    expect(options.ignoreDefaultArgs).toEqual(['--use-mock-keychain', '--password-store=basic', '--no-first-run']);
    expect(options.args).toEqual(['--disable-sync', '--no-default-browser-check', '--profile-directory=Default']);
    expect(options.env).toBe(env);
    expect(options.serviceWorkers).toBe('block');
    expect(options.args.some(arg => /onboarding|skip-login|remote-debugging-port/.test(arg))).toBe(false);
  });

  test('Mac native spawn policy refuses sandbox-disabling arguments regardless of caller options', () => {
    const descriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
    const profile = path.join(root, 'mac-sandbox-policy');
    const childProcess = require('node:child_process');
    const observer = observeBrowserLaunches(new Map([[process.execPath, profile]]));
    try {
      Object.defineProperty(process, 'platform', { ...descriptor, value: 'darwin' });
      for (const disabling of [['--no-sandbox'], ['--no-sandbox=false'], ['--disable-sandbox'], ['--disable-gpu-sandbox'],
        ['--disable-setuid-sandbox'], ['--disable-seccomp-filter-sandbox'], ['--disable-namespace-sandbox'], ['--no-zygote-sandbox'],
        ['--single-process'], ['--in-process-gpu'], ['--disable-features=GpuSandboxV2'], ['--disable-features', 'RendererSandbox']]) {
        expect(hasSandboxDisablingArgument(disabling)).toBe(true);
        expect(() => childProcess.spawn(process.execPath, ['--remote-debugging-pipe', '--user-data-dir=' + profile, ...disabling], {
          detached: true, shell: false, stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'], chromiumSandbox: false,
          allowSandboxDisable: true, env: { DISABLE_SANDBOX: '1' },
        })).toThrow('browser_launch_policy_rejected');
        expect(observer.attempts.at(-1)).toMatchObject({ sandboxRequired: true, sandboxDisablingFlag: true });
      }
      expect(observer.children).toHaveLength(0);
    } finally { Object.defineProperty(process, 'platform', descriptor); observer.restore(); }
    expect(hasSandboxDisablingArgument(['--headless', '--disable-sync', '--disable-features=MediaRouter,Translate'])).toBe(false);
  });

  test('startup admits only blank pages or the exact synthetic loopback origin', () => {
    const origin = 'http://127.0.0.1:8123';
    expect(allowedFixturePage('about:blank', origin)).toBe(true);
    expect(allowedFixturePage(origin + '/seed', origin)).toBe(true);
    for (const url of ['https://www.diabrowser.com/login', 'dia://onboarding', 'chrome://welcome', 'http://localhost:8123/seed',
      'http://127.0.0.1:8124/seed', 'javascript:alert(1)', 'about:config', 'invalid']) expect(allowedFixturePage(url, origin)).toBe(false);
    const authenticated = new URL(origin);
    authenticated.username = 'fixture-user';
    authenticated.password = 'fixture';
    expect(allowedFixturePage(authenticated.href, origin)).toBe(false);
  });

  test('startup diagnostics classify pages without exposing URLs or broadening admission', () => {
    const pages = [
      ['about:blank', 'blank'], ['about:blank#synthetic-private-value', 'other_about'],
      ['chrome://newtab/?token=synthetic-private-value', 'chromium_new_tab'],
      ['chrome://new-tab-page/', 'chromium_new_tab'], ['chrome://intro/', 'chromium_onboarding'],
      ['chrome://welcome/', 'chromium_onboarding'], ['chrome://settings/', 'chromium_internal'],
      ['dia://onboarding', 'dia_internal'], ['chrome-extension://fixture/path', 'extension'],
      ['https://fixture.invalid/login?token=synthetic-private-value', 'external_web'],
      ['http://127.0.0.1:8123' + '/fixture', 'loopback_web'], ['file:///synthetic-private-value', 'file'],
      ['data:text/html,synthetic-private-value', 'data'], ['invalid synthetic-private-value', 'invalid'],
    ];
    const categories = pages.map(([url]) => browserStartupCategory(url));
    expect(categories).toEqual(pages.map(([, category]) => category));
    expect(JSON.stringify(categories)).not.toContain('synthetic-private-value');
    expect(JSON.stringify(categories)).not.toContain('fixture.invalid');
    for (const [url] of pages.slice(1, 10)) expect(allowedFixturePage(url, 'http://127.0.0.1:8123')).toBe(false);
  });

  test('browser stderr classifies only known policy, pipe, Keychain, loader and bootstrap diagnostics', () => {
    for (const [line, reason] of [
      ['DevTools remote debugging requires a non-default data directory. Specify this using --user-data-dir.', 'default_profile_policy'],
      ['Remote debugging pipe file descriptors are not open.', 'debugging_pipe_unavailable'],
      ['errSecInteractionNotAllowed: User interaction is not allowed.', 'keychain_interaction_disallowed'],
      ['errSecInteractionRequired', 'keychain_interaction_required'],
      ['errSecAuthFailed', 'keychain_access_failed'],
      ['dyld[123]: Library not loaded:', 'dynamic_library_error'],
      ['code signature invalid', 'code_signing_error'],
      ['bootstrap_check_in failed', 'graphics_or_bootstrap_error'],
      ['ProcessSingleton', 'browser_profile_unavailable'],
    ]) {
      const reasons = browserStderrReasons(line + ' synthetic-private-value /private/fixture/profile');
      expect(reasons).toContain(reason);
      expect(JSON.stringify(reasons)).not.toContain('synthetic-private');
      expect(JSON.stringify(reasons)).not.toContain('/private');
    }
    for (const line of ['using a non-default data directory', 'remote-debugging-pipe enabled', 'Waiting for Keychain',
      'WindowServer connection available', 'private unknown diagnostic']) expect(browserStderrReasons(line)).toEqual([]);
  });

  test('stderr capture handles chunk boundaries and final unterminated lines without retaining text', () => {
    const capture = createBrowserStderrCapture();
    const policy = 'DevTools remote debugging requires a non-default data directory.';
    capture.consume(Buffer.from('synthetic-private-value\n' + policy.slice(0, 23)));
    expect(capture.snapshot().reasonCounts.default_profile_policy).toBe(0);
    capture.consume(Buffer.from(policy.slice(23)));
    const before = capture.snapshot();
    expect(before.reasonCounts.default_profile_policy).toBe(1);
    capture.consume(Buffer.from('\n' + policy));
    capture.end();
    expect(capture.snapshot().reasonCounts.default_profile_policy).toBe(2);
    expect(before.reasonCounts.default_profile_policy).toBe(1);
    expect(capture.snapshot().ended).toBe(true);
    expect(JSON.stringify(capture.snapshot())).not.toContain('synthetic-private');
    expect(JSON.stringify(capture.snapshot())).not.toContain('DevTools');
  });

  test('stderr inspection caps bytes and pending line size while exposing truncation honestly', () => {
    const capture = createBrowserStderrCapture();
    capture.consume(Buffer.alloc(65_536, 120));
    capture.consume(Buffer.from('\nDevTools remote debugging requires a non-default data directory.\n'));
    const facts = capture.snapshot();
    expect(facts.bytesInspected).toBe(65_536);
    expect(facts.bytesSeen).toBeGreaterThan(65_536);
    expect(facts.truncated).toBe(true);
    expect(facts.discardedLongLines).toBe(1);
    expect(facts.reasonCounts.default_profile_policy).toBe(0);
    const lines = createBrowserStderrCapture();
    lines.consume('x'.repeat(5000) + '\nRemote debugging pipe file descriptors are not open.\n');
    expect(lines.snapshot().reasonCounts.debugging_pipe_unavailable).toBe(1);
    expect(lines.snapshot().truncated).toBe(true);
  });

  test('causal stderr reasons outrank a generic timeout without changing its timeout identity', () => {
    const timeout = Object.assign(new Error('synthetic-private-timeout'), { name: 'TimeoutError' });
    expect(browserOperationTimedOut(timeout)).toBe(true);
    expect(browserPreflightError(timeout)).toBe('operation_timeout');
    expect(browserPreflightError(timeout, ['default_profile_policy'])).toBe('default_profile_policy');
    expect(browserPreflightError(timeout, ['debugging_pipe_unavailable'])).toBe('debugging_pipe_unavailable');
    expect(browserPreflightError(timeout, ['keychain_interaction_required'])).toBe('keychain_interaction_required');
    const embedded = Object.assign(new Error('Timed out\nDevTools remote debugging requires a non-default data directory.'), { name: 'TimeoutError' });
    expect(browserPreflightError(embedded)).toBe('default_profile_policy');
    expect(browserOperationTimedOut(embedded)).toBe(true);
  });

  test('stderr snapshots keep source, destination, and cleanup-time observations separate', () => {
    const source = createBrowserStderrCapture();
    const destination = createBrowserStderrCapture();
    source.consume('DevTools remote debugging requires a non-default data directory.\n');
    const beforeCleanup = source.snapshot();
    source.consume('bootstrap_check_in failed\n');
    destination.consume('Remote debugging pipe file descriptors are not open.\n');
    expect(beforeCleanup.reasonCounts.graphics_or_bootstrap_error).toBe(0);
    expect(source.snapshot().reasonCounts.graphics_or_bootstrap_error).toBe(1);
    expect(destination.snapshot().reasonCounts.default_profile_policy).toBe(0);
    expect(destination.snapshot().reasonCounts.debugging_pipe_unavailable).toBe(1);
  });

  test('signed macOS requirements compare numeric versions and preserve unknown metadata', () => {
    expect(macosCompatibility({ LSMinimumSystemVersion: '14.0' }, '15.6.1')).toEqual({ hostVersion: '15.6.1',
      minimumSystemVersion: '14.0', minimumArm64Version: null, compatible: true });
    expect(macosCompatibility({ LSMinimumSystemVersion: '26.0' }, '15.6.1').compatible).toBe(false);
    expect(macosCompatibility({ LSMinimumSystemVersion: '15.9' }, '15.10').compatible).toBe(true);
    expect(macosCompatibility({ LSMinimumSystemVersion: '15.6.1' }, '15.6').compatible).toBe(false);
    expect(macosCompatibility({ LSMinimumSystemVersion: '15.6' }, '15.6.0').compatible).toBe(true);
    expect(macosCompatibility({ LSMinimumSystemVersion: '14.0', LSMinimumSystemVersionByArchitecture: { arm64: '26.0' } }, '15.6.1').compatible).toBe(false);
    expect(macosCompatibility({ LSMinimumSystemVersion: '26.0', LSMinimumSystemVersionByArchitecture: { arm64: '14.0' } }, '15.6.1').compatible).toBe(false);
    expect(macosCompatibility({ LSMinimumSystemVersionByArchitecture: { arm64: '14.0' } }, '15.6.1').compatible).toBe(true);
    for (const plist of [{}, null, { LSMinimumSystemVersion: 'synthetic-private-value' }, { LSMinimumSystemVersion: 14 },
      { LSMinimumSystemVersion: '14.0', LSMinimumSystemVersionByArchitecture: 'synthetic-private-value' },
      { LSMinimumSystemVersion: '14.0', LSMinimumSystemVersionByArchitecture: [] },
      { LSMinimumSystemVersion: '14.0', LSMinimumSystemVersionByArchitecture: { arm64: 'private-version' } }]) {
      const facts = macosCompatibility(plist, '15.6.1');
      expect(facts.compatible).toBeNull();
      expect(JSON.stringify(facts)).not.toContain('private');
    }
    expect(macosCompatibility({ LSMinimumSystemVersion: '14.0' }, 'private-host-version').compatible).toBeNull();
  });

  test('bounded startup categories do not hide a disallowed page beyond the receipt limit', () => {
    const urls = [...Array(64).fill('about:blank'), 'https://private.invalid/?token=synthetic-private-value'];
    const facts = browserStartupFacts(urls, 'http://127.0.0.1:8123');
    expect(facts).toMatchObject({ count: 65, truncated: true, allowed: false });
    expect(facts.categories).toHaveLength(64);
    expect(JSON.stringify(facts)).not.toContain('private');
  });

  test('browser root facts retain exit and allowlisted signal evidence without process payloads', () => {
    const facts = browserRootFacts([
      { pid: 300, process: { exitCode: null, signalCode: null, spawnargs: ['synthetic-private-value'] } },
      { pid: 301, process: { exitCode: 0, signalCode: null } },
      { pid: 302, process: { exitCode: null, signalCode: 'SIGABRT' } },
      { pid: 303, process: { exitCode: null, signalCode: 'synthetic-private-signal' } },
    ] as any);
    expect(facts).toEqual([{ pid: 300, exitCode: null, signal: null }, { pid: 301, exitCode: 0, signal: null },
      { pid: 302, exitCode: null, signal: 'SIGABRT' }, { pid: 303, exitCode: null, signal: 'other' }]);
    expect(JSON.stringify(facts)).not.toContain('private');
  });

  test('browser cleanup distinguishes live groups from signal errors without retaining raw errors', () => {
    expect(browserCleanupError(new Error('owned_process_group_still_live')).reason).toBe('group_still_live');
    expect(browserCleanupError(new Error('cleanup_budget_exhausted')).reason).toBe('cleanup_deadline');
    expect(browserCleanupError(Object.assign(new Error('synthetic-private-value'), { code: 'EPERM', errno: 1 })))
      .toEqual({ reason: 'signal_or_probe_failed', code: 'EPERM', errno: 1 });
    const unknown = browserCleanupError({ message: 'synthetic-private-value', code: 'private-code', errno: 'private-errno' });
    expect(unknown).toEqual({ reason: 'signal_or_probe_failed', code: 'unclassified', errno: null });
  });

  test('process-group diagnostics distinguish owned zombies, live members, and unrelated UID counts', () => {
    const facts = browserGroupFacts('20000 300 1 300 Z\n20000 301 1 300 S+\n501 302 1 300 S\n20000 400 1 400 S\n', 20000, 300);
    expect(facts).toEqual({ available: true, count: 2, foreignUidCount: 1, zombies: 1, live: 1, truncated: false,
      processes: [{ pid: 300, ppid: 1, state: 'Z' }, { pid: 301, ppid: 1, state: 'S' }] });
    expect(browserGroupFacts(Array.from({ length: 70 }, (_, index) => `20000 ${index + 300} 1 300 S`).join('\n'), 20000, 300).processes).toHaveLength(64);
    expect(() => browserGroupFacts('private-invalid-row', 20000, 300)).toThrow('invalid_group_snapshot');
    expect(() => browserGroupFacts('', 20000, 0)).toThrow('invalid_group_snapshot_target');
  });

  test('native samples retain fixed wait families only from call-graph frames', () => {
    const output = `Process: private-process [123]
Path: /private/sensitive/Security/AppKit/CFNetwork
Call graph:
    100 Thread_11 DispatchQueue_1: com.apple.main-thread (serial)
    + 100 NSApplicationMain (in AppKit) private-source-path
    +   100 SecKeychainFindGenericPassword (in Security) private-item-name
    +     100 mach_msg_trap (in libsystem_kernel)
    100 Thread_12 private-thread-name
    + 100 NSURLSessionTask (in CFNetwork) private-request-url
Total number in stack (recursive counted multiple):
    999 SecItemCopyMatching private-unrelated-summary
Binary Images:
    Security AppKit CFNetwork /private/image/path
`;
    const result = classifyNativeWaitSample(output);
    expect(result).toEqual({ available: true, callGraphSeen: true, mainThreadSeen: true, frames: 4,
      frameCounts: { security_keychain: 1, appkit_bootstrap: 1, network: 1, runloop: 1 },
      mainThreadFrameCounts: { security_keychain: 1, appkit_bootstrap: 1, network: 0, runloop: 1 },
      shape: { graphLines: 6, nonemptyGraphLines: 6, threadTokenLines: 2, numericPrefixLines: 2, imageAnnotatedLines: 4,
        nonAsciiGraphLines: 0, unrecognizedGraphLines: 0, graphEnd: 'totals', binaryImagesSeen: true } });
    expect(JSON.stringify(result)).not.toContain('private');
    expect(JSON.stringify(result)).not.toContain('SecKeychain');
    expect(classifyNativeWaitSample('private missing call graph').available).toBe(false);
    expect(classifyNativeWaitSample('x'.repeat(1024 * 1024 + 1))).toEqual({ available: false, reason: 'sample_output_oversized' });
  });

  test('sample structure distinguishes an empty graph from unrecognized stack rows without exposing text', () => {
    const empty = classifyNativeWaitSample('Call graph:\n\nTotal number in stack:\nBinary Images:\nprivate-image');
    expect(empty).toMatchObject({ available: false, frames: 0, callGraphSeen: true,
      shape: { graphLines: 1, nonemptyGraphLines: 0, unrecognizedGraphLines: 0, graphEnd: 'totals', binaryImagesSeen: true } });
    const unfamiliar = classifyNativeWaitSample('Call graph:\n ◇ private-row (in Security)\nBinary Images:\nprivate-image');
    expect(unfamiliar).toMatchObject({ available: false, frames: 0,
      shape: { nonemptyGraphLines: 1, unrecognizedGraphLines: 1, nonAsciiGraphLines: 1, imageAnnotatedLines: 1, graphEnd: 'binary_images' } });
    expect(JSON.stringify(unfamiliar)).not.toContain('private');
    expect(JSON.stringify(unfamiliar)).not.toContain('Security');
  });

  test('a pending launch is sampled once with a deadline before the native launch timeout', async () => {
    let resolve!: (value: string) => void;
    const pending = new Promise<string>(done => { resolve = done; });
    const started = performance.now();
    const deadlines: number[] = [];
    const result = await observePendingBrowserLaunch(() => pending, deadline => { deadlines.push(deadline); resolve('ready'); }, started + 60_000, 5);
    expect(result).toBe('ready');
    expect(deadlines).toHaveLength(1);
    expect(deadlines[0]).toBeLessThan(started + 30_000);
    expect(deadlines[0]).toBeGreaterThan(started + 24_000);
  });

  test('settled launches cancel sampling and exhausted sampling windows do not extend the launch', async () => {
    let observations = 0;
    const observe = () => { observations++; };
    expect(await observePendingBrowserLaunch(async () => 'ready', observe, performance.now() + 60_000, 5)).toBe('ready');
    const original = new Error('original_launch_failure');
    await expect(observePendingBrowserLaunch(async () => { throw original; }, observe, performance.now() + 60_000, 5)).rejects.toBe(original);
    expect(await observePendingBrowserLaunch(async () => { await Bun.sleep(10); return 'ready'; }, observe, performance.now() + 100, 0)).toBe('ready');
    await Bun.sleep(10);
    expect(observations).toBe(0);
  });

  test('native wait sampling uses only the observed live child and never writes a stack artifact', () => {
    const pid = 12345;
    const uid = process.getuid!();
    const child: any = { pid, executable: '/owned/Dia', closeObserved: false, process: { pid, exitCode: null, signalCode: null } };
    const calls: string[][] = [];
    const result = sampleOwnedDiaWait(child, uid, child.executable, performance.now() + 10_000, { HOME: root },
      ((command: string, args: string[], options: any) => {
        calls.push([command, ...args]);
        expect(Number.isInteger(options.timeout)).toBe(true);
        expect(options.timeout).toBeGreaterThan(0);
        expect(options.timeout).toBeLessThanOrEqual(5_000);
        expect(options.killSignal).toBe('SIGKILL');
        if (command === '/bin/ps') return { status: 0, stdout: `${uid} ${pid} ${process.pid} S Dia\n`, stderr: '' };
        return { status: 0, stdout: 'private-header\nCall graph:\n 10 Thread_1 DispatchQueue_1: com.apple.main-thread\n + 10 CFRunLoopRun (in CoreFoundation) private-path\nBinary Images:\nprivate-image', stderr: '' };
      }) as typeof spawnSync);
    expect(calls).toEqual([['/bin/ps', '-p', String(pid), '-o', 'uid=,pid=,ppid=,state=,ucomm='],
      ['/usr/bin/sample', String(pid), '1', '10', '-file', '/dev/stdout']]);
    expect(result).toMatchObject({ available: true, attempted: true, ownedLiveChildConfirmed: true, reason: 'sampled',
      waitFamilies: { mainThreadFrameCounts: { runloop: 1 } } });
    expect(JSON.stringify(result)).not.toContain('private-');
    expect(JSON.stringify(result)).not.toContain('CFRunLoopRun');
  });

  test('sampling refuses changed identity, zombies, and closed roots without attempting a native sample', () => {
    const uid = process.getuid!();
    const child: any = { pid: 12345, executable: '/owned/Dia', closeObserved: false, process: { pid: 12345, exitCode: null, signalCode: null } };
    for (const row of [`${uid + 1} 12345 ${process.pid} S Dia`, `${uid} 12345 ${process.pid + 1} S Dia`,
      `${uid} 12345 ${process.pid} Z Dia`, `${uid} 12345 ${process.pid} S other`, `${uid} 12346 ${process.pid} S Dia`]) {
      let calls = 0;
      const result = sampleOwnedDiaWait(child, uid, child.executable, performance.now() + 10_000, {},
        ((command: string) => { calls++; expect(command).toBe('/bin/ps'); return { status: 0, stdout: row, stderr: '' }; }) as typeof spawnSync);
      expect(calls).toBe(1);
      expect(result.attempted).toBe(false);
    }
    for (const changed of [{ ...child, closeObserved: true }, { ...child, executable: '/other/Chromium' },
      { ...child, process: { ...child.process, exitCode: 0 } }]) {
      const result = sampleOwnedDiaWait(changed, uid, '/owned/Dia', performance.now() + 10_000, {}, (() => { throw new Error('must_not_spawn'); }) as typeof spawnSync);
      expect(result).toMatchObject({ available: false, attempted: false });
    }
  });

  test('sampling reports OS permission refusal without escalation or raw failure text', () => {
    const uid = process.getuid!();
    const child: any = { pid: 12345, executable: '/owned/Dia', closeObserved: false, process: { pid: 12345, exitCode: null, signalCode: null } };
    const result = sampleOwnedDiaWait(child, uid, child.executable, performance.now() + 10_000, {},
      ((command: string) => command === '/bin/ps'
        ? { status: 0, stdout: `${uid} 12345 ${process.pid} S Dia`, stderr: '' }
        : { status: 1, stdout: '', stderr: 'Failed to get task for pid: private-process-path. Operation not permitted.' }) as typeof spawnSync);
    expect(result).toMatchObject({ available: false, attempted: true, reason: 'sampling_permission_denied' });
    expect(JSON.stringify(result)).not.toContain('private-process');
  });

  test('child close joining stays within its deadline and refuses an unconfirmed close', async () => {
    await expect(joinOwnedBrowserClose({ closed: Promise.resolve(), closeObserved: false } as any, performance.now() + 1000))
      .rejects.toThrow('owned_child_close_unconfirmed');
    await expect(joinOwnedBrowserClose({ closed: new Promise(() => {}), closeObserved: false } as any, performance.now() + 5))
      .rejects.toThrow('operation_timeout');
    await expect(joinOwnedBrowserClose({ closed: Promise.resolve(), closeObserved: true } as any, 0))
      .rejects.toThrow('cleanup_budget_exhausted');
  });

  for (const phase of ['probe', 'signal']) {
    test(`an initial ${phase} error is retained while child reaping still precedes the final absence proof`, async () => {
      const facts: Record<string, any> = { signalSent: false, absenceConfirmed: false };
      const child: any = { pid: 12345, closeObserved: false };
      child.closed = Promise.resolve().then(() => { child.closeObserved = true; });
      const calls: Array<0 | 'SIGKILL'> = [];
      await stopOwnedBrowserGroup(child, performance.now() + 1000, facts, (_pid, signal) => {
        calls.push(signal);
        if (!child.closeObserved) {
          if (phase === 'signal' && signal === 0) return;
          throw Object.assign(new Error('private-probe-error'), { code: 'EPERM', errno: 1 });
        }
        throw Object.assign(new Error('gone'), { code: 'ESRCH' });
      });
      expect(calls).toEqual(phase === 'probe' ? [0, 0] : [0, 'SIGKILL', 0]);
      expect(facts).toMatchObject({ stage: 'completed', signalSent: false, childCloseObserved: true, absenceConfirmed: true,
        initialSignalFailure: { stage: phase === 'probe' ? 'probe_before_signal' : 'signal', code: 'EPERM', errno: 1 } });
      expect(JSON.stringify(facts)).not.toContain('private-probe-error');
    });
  }

  test('permission errors and zombies never replace the required child close and actual group absence', async () => {
    const facts = { signalSent: false, absenceConfirmed: false };
    const waiting: any = { pid: 12345, closed: new Promise(() => {}), closeObserved: false };
    const denied = () => { throw Object.assign(new Error('denied'), { code: 'EPERM' }); };
    await expect(stopOwnedBrowserGroup(waiting, performance.now() + 10, facts, denied)).rejects.toThrow('operation_timeout');
    expect(facts.absenceConfirmed).toBe(false);
    const closed: any = { pid: 12345, closed: Promise.resolve(), closeObserved: true };
    await expect(stopOwnedBrowserGroup(closed, performance.now() + 1000, facts, denied)).rejects.toMatchObject({ code: 'EPERM' });
    expect(facts.absenceConfirmed).toBe(false);
    await expect(stopOwnedBrowserGroup(closed, performance.now() + 10, facts, () => {})).rejects.toThrow('owned_process_group_still_live');
    expect(facts.absenceConfirmed).toBe(false);
  });
  for (const [error, category] of [
    [new Error('browserType.launchPersistentContext: browser_launch_policy_rejected synthetic-private-value'), 'launch_policy_rejected'],
    [new Error('background_browser_ownership_failed'), 'ownership_unconfirmed'],
    [new Error('background_browser_startup_page_rejected'), 'startup_page_rejected'],
    [new Error('background_browser_render_failed'), 'render_mismatch'],
    [Object.assign(new Error('synthetic-private-value'), { name: 'TimeoutError' }), 'operation_timeout'],
    [new Error('native_operation_timed_out'), 'operation_timeout'],
    [new Error('operation_timeout'), 'operation_timeout'],
    [new Error('qualification_budget_exhausted'), 'operation_timeout'],
    [new Error('source_process_ownership_unconfirmed'), 'ownership_unconfirmed'],
    [new Error('destination_process_ownership_unconfirmed'), 'ownership_unconfirmed'],
    [new Error('onboarding_or_external_page'), 'startup_page_rejected'],
    [Object.assign(new Error('synthetic-private-value'), { code: 'ENOENT' }), 'executable_unavailable'],
    [Object.assign(new Error('synthetic-private-value'), { code: 'EACCES' }), 'permission_denied'],
    [{ name: 'ResolveMessage', code: 'ERR_MODULE_NOT_FOUND', message: 'synthetic-private-value' }, 'module_unavailable'],
    [Object.assign(new Error('synthetic-private-value'), { code: 'MODULE_NOT_FOUND' }), 'module_unavailable'],
    [Object.assign(new Error('synthetic-private-value'), { code: 'ERR_PACKAGE_PATH_NOT_EXPORTED' }), 'module_export_unavailable'],
    [Object.assign(new Error('synthetic-private-value'), { code: 'ERR_REQUIRE_ESM' }), 'module_format_error'],
    [new RangeError('synthetic-private-value'), 'invalid_runtime_range'],
    [new TypeError('synthetic-private-value'), 'runtime_type_error'],
    [new Error('dyld[123]: Library not loaded: synthetic-private-value'), 'dynamic_library_error'],
    [new Error('code signature invalid: synthetic-private-value'), 'code_signing_error'],
    [new Error('ProcessSingleton synthetic-private-value'), 'browser_profile_unavailable'],
    [new Error('bootstrap_check_in failed synthetic-private-value'), 'graphics_or_bootstrap_error'],
    [new Error('Target page, context or browser has been closed synthetic-private-value'), 'target_closed'],
    [new Error('Protocol error: synthetic-private-value'), 'protocol_error'],
    [new Error('synthetic-private-value'), 'unclassified_browser_error'],
    [{ code: 'synthetic-private-value', message: 'synthetic-private-value' }, 'unclassified_browser_error'],
  ] as const) {
    test(`browser diagnostics return only the allowlisted ${category} category`, () => {
      expect(browserPreflightError(error)).toBe(category);
      expect(browserPreflightError(error)).not.toContain('synthetic-private-value');
    });
  }

  test('module-load facts retain only known error identifiers and known dependency filenames', () => {
    const snapshot = realpathSync(mkdtempSync(path.join(root, 'module-facts-')));
    const packageDirectory = path.join(snapshot, 'node_modules/playwright');
    mkdirSync(packageDirectory, { recursive: true });
    writeFileSync(path.join(packageDirectory, 'package.json'), '{}', { mode: 0o600 });
    const facts = playwrightModuleLoadFacts(snapshot, { name: 'ResolveMessage', code: 'ERR_MODULE_NOT_FOUND',
      message: "Cannot find package 'playwright' imported from /synthetic-private-value/worker.ts" });
    expect(facts.errorType).toBe('ResolveMessage');
    expect(facts.errorCode).toBe('ERR_MODULE_NOT_FOUND');
    expect(facts.requestedModule).toBe('playwright');
    expect(facts.files['playwright/package.json']).toEqual({ exists: true, readable: true, ownedByCurrentUid: true, insideSnapshot: true });
    expect(facts.files['playwright-core/lib/coreBundle.js'].exists).toBe(false);
    expect(JSON.stringify(facts)).not.toContain('synthetic-private-value');
    expect(JSON.stringify(facts)).not.toContain(snapshot);
    const unknown = playwrightModuleLoadFacts(snapshot, { name: 'synthetic-private-value', code: 'synthetic-private-value', message: "Cannot find package 'synthetic-private-value'" });
    expect(unknown.errorType).toBe('unclassified');
    expect(unknown.errorCode).toBe('unclassified');
    expect(unknown.requestedModule).toBe('unclassified');
    expect(JSON.stringify(unknown)).not.toContain('synthetic-private-value');
  });

  test('Keychain snapshots preserve exact quoted paths without shell parsing', () => {
    expect(parseKeychainPaths('    "/Users/runner/Library/Keychains/login.keychain-db"\n    "/tmp/fixture keychain.keychain-db"\n'))
      .toEqual(['/Users/runner/Library/Keychains/login.keychain-db', '/tmp/fixture keychain.keychain-db']);
    for (const output of ['', 'not-json', '"relative-path"', '42', '"/valid/path"\ninvalid']) {
      expect(() => parseKeychainPaths(output)).toThrow();
    }
  });

  test('fresh users can have an empty user search list and no default Keychain', () => {
    const calls: string[][] = [];
    const snapshot = captureUserKeychains({ HOME: root }, [root], 1000, (args, timeout) => {
      calls.push(args);
      expect(timeout).toBeGreaterThan(0);
      expect(timeout).toBeLessThanOrEqual(1000);
      return args[0] === 'list-keychains' ? { status: 0, stdout: '', stderr: '' }
        : { status: 1, stdout: '', stderr: 'security: SecKeychainCopyDomainDefault user: A default keychain could not be found.\n' };
    });
    expect(snapshot).toEqual({ search: [], default: [] });
    expect(calls).toEqual([['list-keychains', '-d', 'user'], ['default-keychain', '-d', 'user']]);
  });

  test('computed Keychain timeouts reach real spawnSync as bounded integer milliseconds', () => {
    let reads = 0;
    const times = [0.125, 0.5, 5.75];
    const clock = spyOn(performance, 'now').mockImplementation(() => times[Math.min(reads++, times.length - 1)]);
    const timeouts: number[] = [];
    const calls: string[][] = [];
    try {
      const snapshot = captureUserKeychains({ HOME: root }, [root], 10_000, (args, timeout) => {
        const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros',
          `--config=${process.platform === 'win32' ? 'NUL' : '/dev/null'}`, '-e', 'process.exit(0)'], {
          cwd: root, env: { HOME: root, PATH: path.dirname(process.execPath) }, encoding: 'utf8', timeout,
        });
        expect(result.status).toBe(0);
        expect(result.error).toBeUndefined();
        timeouts.push(timeout);
        calls.push(args);
        return result;
      });
      expect(snapshot).toEqual({ search: [], default: [] });
      expect(timeouts).toEqual([9999, 9994]);
      expect(calls).toEqual([['list-keychains', '-d', 'user'], ['default-keychain', '-d', 'user']]);
    } finally {
      clock.mockRestore();
    }
  });

  test('an expired or sub-millisecond Keychain budget never becomes an unbounded subprocess', () => {
    const clock = spyOn(performance, 'now').mockReturnValue(100);
    let commands = 0;
    try {
      for (const budget of [0.75, 0, -1, NaN, Infinity]) {
        expect(() => captureUserKeychains({ HOME: root }, [root], budget, () => {
          commands++;
          return { status: 0, stdout: '', stderr: '' };
        })).toThrow('user_keychain_probe_timeout');
      }
      expect(commands).toBe(0);
    } finally {
      clock.mockRestore();
    }
  });

  test('permission, securityd, and transport errors are never mistaken for no default Keychain', () => {
    for (const result of [
      { status: 1, stdout: '', stderr: 'security: SecKeychainCopyDefault: User interaction is not allowed.' },
      { status: 1, stdout: '', stderr: 'security: SecKeychainCopyDomainDefault system: A default keychain could not be found.' },
      { status: 1, stdout: '', stderr: 'synthetic-private-error' },
      { status: 0, stdout: '', stderr: 'synthetic-private-error' },
      { status: 1, stdout: 'unexpected-data', stderr: 'security: SecKeychainCopyDefault: A default keychain could not be found.' },
      { status: null, stdout: '', stderr: '', error: new Error('synthetic-private-error') },
    ]) expect(() => parseDefaultKeychain(result)).toThrow('user_default_keychain_unavailable');
    expect(parseDefaultKeychain({ status: 0, stdout: '', stderr: '' })).toEqual([]);
    expect(parseDefaultKeychain({ status: 1, stdout: '', stderr: 'security: SecKeychainCopyDefault: A default keychain could not be found.' })).toEqual([]);
  });

  test('the snapshot boundary rejects System Keychain fallback and paths outside the owned home', () => {
    for (const file of ['/Library/Keychains/System.keychain', '/System/Library/Keychains/SystemRootCertificates.keychain', '/unowned/keychain']) {
      expect(() => captureUserKeychains({ HOME: root }, [root], 1000, args => ({ status: 0,
        stdout: args[0] === 'list-keychains' ? JSON.stringify(file) : '', stderr: '' })))
        .toThrow('keychain_outside_owned_home_refused');
    }
  });

  test('a fresh Keychain home gains only owned standard directories, not a fabricated preference file', () => {
    const home = realpathSync(mkdtempSync(path.join(root, 'keychain-home-')));
    expect(prepareKeychainHome(home)).toEqual({ before: { Library: false, 'Library/Preferences': false, 'Library/Keychains': false }, directoriesReady: true });
    for (const directory of ['Library', 'Library/Preferences', 'Library/Keychains']) {
      expect(lstatSync(path.join(home, directory)).uid).toBe(process.getuid!());
      expect(lstatSync(path.join(home, directory)).isDirectory()).toBe(true);
    }
    const preferences = path.join(home, 'Library/Preferences/com.apple.security.plist');
    expect(existsSync(preferences)).toBe(false);
    expect(existsSync(path.join(home, 'Library/Safari'))).toBe(false);
    writeFileSync(preferences, 'opaque fixture preferences', { mode: 0o600 });
    expect(prepareKeychainHome(home).before).toEqual({ Library: true, 'Library/Preferences': true, 'Library/Keychains': true });
    expect(readFileSync(preferences, 'utf8')).toBe('opaque fixture preferences');
  });

  test('home preparation rejects a linked or unowned home without writing through it', () => {
    const home = realpathSync(mkdtempSync(path.join(root, 'linked-home-')));
    const elsewhere = realpathSync(mkdtempSync(path.join(root, 'other-home-')));
    symlinkSync(elsewhere, path.join(home, 'Library'), 'dir');
    expect(() => prepareKeychainHome(home)).toThrow('keychain_home_unsafe');
    expect(readdirSync(elsewhere)).toEqual([]);
    expect(() => prepareKeychainHome(elsewhere, process.getuid!() + 1)).toThrow('keychain_home_unsafe');
    expect(readdirSync(elsewhere)).toEqual([]);
  });

  for (const mismatch of ['search-empty', 'default-empty', 'search-path', 'default-path', 'search-error', 'default-error', 'read-mismatch', 'read-error']) {
    test(`Keychain diagnostics observe the explicit read independently of ${mismatch}`, () => {
      const directory = realpathSync(mkdtempSync(path.join(root, 'keychain-facts-')));
      const keychain = path.join(directory, 'fixture.keychain-db');
      const other = path.join(directory, 'other.keychain-db');
      writeFileSync(keychain, 'opaque synthetic keychain', { mode: 0o600 });
      writeFileSync(other, 'other synthetic keychain', { mode: 0o600 });
      const expected = 'synthetic-private-equality-value';
      const calls: string[][] = [];
      const facts = observeFixtureKeychain({ HOME: directory }, [directory], keychain, expected, 1000, (args, timeout) => {
        expect(Number.isInteger(timeout)).toBe(true);
        expect(timeout).toBeGreaterThan(0);
        calls.push(args);
        if (args[0] === 'list-keychains') return mismatch === 'search-error'
          ? { status: 1, stdout: '', stderr: 'synthetic-private-error' }
          : { status: 0, stdout: mismatch === 'search-empty' ? '' : JSON.stringify(mismatch === 'search-path' ? other : keychain), stderr: '' };
        if (args[0] === 'default-keychain') return mismatch === 'default-error'
          ? { status: 1, stdout: '', stderr: 'synthetic-private-error' }
          : mismatch === 'default-empty'
            ? { status: 1, stdout: '', stderr: 'security: SecKeychainCopyDomainDefault user: A default keychain could not be found.' }
            : { status: 0, stdout: JSON.stringify(mismatch === 'default-path' ? other : keychain), stderr: '' };
        if (mismatch === 'read-error') return { status: 1, stdout: '', stderr: 'synthetic-private-error' };
        return { status: 0, stdout: mismatch === 'read-mismatch' ? 'other synthetic value' : expected + '\n', stderr: '' };
      });
      expect(calls).toEqual([['list-keychains', '-d', 'user'], ['default-keychain', '-d', 'user'],
        ['find-generic-password', '-s', 'Gstack Native Probe', '-w', keychain]]);
      expect(facts.searchCount).toBe(mismatch === 'search-error' ? null : mismatch === 'search-empty' ? 0 : 1);
      expect(facts.searchPathMatches).toBe(!mismatch.startsWith('search-'));
      expect(facts.defaultCount).toBe(mismatch === 'default-error' ? null : mismatch === 'default-empty' ? 0 : 1);
      expect(facts.defaultPathMatches).toBe(!mismatch.startsWith('default-'));
      expect(facts.explicitReadAttempted).toBe(true);
      expect(facts.explicitReadSucceeded).toBe(mismatch !== 'read-error');
      expect(facts.explicitReadMatches).toBe(!mismatch.startsWith('read-'));
      expect(JSON.stringify(facts)).not.toContain(expected);
      expect(JSON.stringify(facts)).not.toContain('synthetic-private-error');
      expect(JSON.stringify(facts)).not.toContain(keychain);
    });
  }

  test('Dia Keychain diagnostics distinguish both HOME environments without configuring the shadow home', () => {
    const directory = realpathSync(mkdtempSync(path.join(root, 'dual-keychain-')));
    const registered = path.join(directory, 'registered');
    const shadow = path.join(directory, 'shadow');
    mkdirSync(registered);
    mkdirSync(shadow);
    prepareKeychainHome(registered);
    writeFileSync(path.join(registered, 'Library/Preferences/com.apple.security.plist'), 'opaque private fixture preference');
    const keychain = path.join(directory, 'fixture.keychain-db');
    writeFileSync(keychain, 'opaque synthetic keychain', { mode: 0o600 });
    const expected = 'synthetic-private-dual-home-value';
    const environments = { keychainHome: { HOME: registered }, profileHome: { HOME: shadow } };
    const calls: Array<{ home: string; args: string[] }> = [];
    const observed = observeDiaKeychainEnvironments(environments, [directory], keychain, expected, 20_000, (env, args, timeout) => {
      expect(Number.isInteger(timeout)).toBe(true);
      expect(timeout).toBeGreaterThan(0);
      expect(timeout).toBeLessThanOrEqual(10_000);
      calls.push({ home: env.HOME, args });
      if (args[0] === 'list-keychains') return { status: 0, stdout: env.HOME === registered ? JSON.stringify(keychain) : '', stderr: '' };
      if (args[0] === 'default-keychain') return env.HOME === registered
        ? { status: 0, stdout: JSON.stringify(keychain), stderr: '' }
        : { status: 1, stdout: '', stderr: 'security: SecKeychainCopyDomainDefault user: A default keychain could not be found.' };
      expect(args.slice(0, 4)).toEqual(['find-generic-password', '-s', 'Dia Safe Storage', '-w']);
      return { status: 0, stdout: expected, stderr: '' };
    });
    expect(observed.firstFailure).toEqual({ environment: 'profileHome', check: 'search_path' });
    expect(observed.environments.keychainHome).toMatchObject({ searchCount: 1, searchPathMatches: true, defaultCount: 1, defaultPathMatches: true,
      explicitReadMatches: true, lookupReadAttempted: true, lookupReadMatches: true, preferencesDirectoryExists: true, preferencesFileExists: true });
    expect(observed.environments.profileHome).toMatchObject({ searchCount: 0, searchPathMatches: false, defaultCount: 0, defaultPathMatches: false,
      explicitReadMatches: true, lookupReadAttempted: false, preferencesDirectoryExists: false, preferencesFileExists: false });
    expect(calls).toHaveLength(7);
    expect(calls.filter(call => call.home === shadow)).toHaveLength(3);
    expect(calls.some(call => call.args[0] === 'default-keychain' && call.args.includes('-s'))).toBe(false);
    expect(existsSync(path.join(shadow, 'Library'))).toBe(false);
    const serialized = JSON.stringify(observed);
    for (const privateValue of [expected, registered, shadow, keychain, 'opaque private']) expect(serialized).not.toContain(privateValue);
  });

  for (const failure of ['search', 'default', 'explicit_read']) {
    test(`Dia diagnostic refuses unqualified lookup when the owned ${failure} proof fails`, () => {
      const directory = realpathSync(mkdtempSync(path.join(root, 'guarded-keychain-')));
      const keychain = path.join(directory, 'fixture.keychain-db');
      writeFileSync(keychain, 'opaque synthetic keychain', { mode: 0o600 });
      let implicitCalls = 0;
      const result = observeFixtureKeychain({ HOME: directory }, [directory], keychain, 'expected-private-value', 1000, args => {
        if (args[0] === 'list-keychains') return { status: 0, stdout: failure === 'search' ? '' : JSON.stringify(keychain), stderr: '' };
        if (args[0] === 'default-keychain') return { status: 0, stdout: failure === 'default' ? '' : JSON.stringify(keychain), stderr: '' };
        if (args.length === 4) implicitCalls++;
        return { status: 0, stdout: failure === 'explicit_read' ? 'wrong-private-value' : 'expected-private-value', stderr: '' };
      }, 'Dia Safe Storage');
      expect(result.explicitReadAttempted).toBe(true);
      expect(result.lookupReadAttempted).toBe(false);
      expect(implicitCalls).toBe(0);
    });
  }

  test('both Keychain environments remain observable while the first original validation failure is retained', () => {
    const directory = realpathSync(mkdtempSync(path.join(root, 'keychain-failures-')));
    const keychain = path.join(directory, 'fixture.keychain-db');
    writeFileSync(keychain, 'opaque synthetic keychain', { mode: 0o600 });
    const environments = { keychainHome: { HOME: directory }, profileHome: { HOME: directory, MARKER: 'shadow' } };
    for (const keychainSearchFails of [true, false]) {
      const homesObserved = new Set<Record<string, string>>();
      const observed = observeDiaKeychainEnvironments(environments, [directory], keychain, 'expected-private-value', 20_000, (env, args) => {
        homesObserved.add(env);
        if (args[0] === 'list-keychains') return { status: 0,
          stdout: env === environments.profileHome || keychainSearchFails ? '' : JSON.stringify(keychain), stderr: '' };
        if (args[0] === 'default-keychain') return { status: 1, stdout: '', stderr: 'private-default-error' };
        return { status: 0, stdout: 'wrong-private-value', stderr: '' };
      });
      expect(homesObserved.size).toBe(2);
      expect(observed.firstFailure).toEqual({ environment: keychainSearchFails ? 'keychainHome' : 'profileHome', check: 'search_path' });
      expect(observed.environments.keychainHome).toMatchObject({ defaultCount: null, explicitReadAttempted: true, explicitReadMatches: false });
      expect(observed.environments.profileHome).toMatchObject({ defaultCount: null, explicitReadAttempted: true, explicitReadMatches: false });
      expect(JSON.stringify(observed)).not.toContain('private-default-error');
      expect(JSON.stringify(observed)).not.toContain('wrong-private-value');
    }
  });

  test('Dia environment validation preserves successful and explicit-read-only outcomes', () => {
    const directory = realpathSync(mkdtempSync(path.join(root, 'keychain-outcomes-')));
    const keychain = path.join(directory, 'fixture.keychain-db');
    writeFileSync(keychain, 'opaque synthetic keychain', { mode: 0o600 });
    const environments = { keychainHome: { HOME: directory }, profileHome: { HOME: directory } };
    for (const readMismatch of [false, true]) {
      const observed = observeDiaKeychainEnvironments(environments, [directory], keychain, 'expected-private-value', 20_000, (env, args) => {
        if (args[0] === 'list-keychains' || args[0] === 'default-keychain') return { status: 0, stdout: JSON.stringify(keychain), stderr: '' };
        return { status: 0, stdout: readMismatch && env === environments.keychainHome ? 'wrong-private-value' : 'expected-private-value', stderr: '' };
      });
      if (readMismatch) expect(observed.firstFailure).toEqual({ environment: 'keychainHome', check: 'explicit_read' });
      else expect(observed.firstFailure).toBeUndefined();
      expect(observed.environments.profileHome).toMatchObject({ searchPathMatches: true, defaultPathMatches: true, explicitReadMatches: true,
        lookupReadAttempted: true, lookupReadMatches: true });
    }
  });

  test('an exhausted dual-environment diagnostic budget launches no Keychain commands', () => {
    const directory = realpathSync(mkdtempSync(path.join(root, 'keychain-budget-')));
    const keychain = path.join(directory, 'fixture.keychain-db');
    writeFileSync(keychain, 'opaque synthetic keychain', { mode: 0o600 });
    let calls = 0;
    const observed = observeDiaKeychainEnvironments({ keychainHome: { HOME: directory }, profileHome: { HOME: directory } },
      [directory], keychain, 'expected-private-value', 0, () => { calls++; throw new Error('must_not_spawn'); });
    expect(calls).toBe(0);
    expect(observed.environments.keychainHome).toMatchObject({ searchCount: null, defaultCount: null, explicitReadAttempted: false, lookupReadAttempted: false });
    expect(observed.environments.profileHome).toMatchObject({ searchCount: null, defaultCount: null, explicitReadAttempted: false, lookupReadAttempted: false });
    expect(observed.firstFailure).toEqual({ environment: 'keychainHome', check: 'search_path' });
  });

  test('an originally absent default is restored by deleting only the created fixture, never by a null default setter', () => {
    expect(fixtureKeychainRestoreCommands({ search: [], default: [] }, '/owned/fixture.keychain-db', true)).toEqual([
      ['delete-keychain', '/owned/fixture.keychain-db'], ['list-keychains', '-d', 'user', '-s'],
    ]);
    expect(fixtureKeychainRestoreCommands({ search: [], default: [] }, '/owned/fixture.keychain-db', false)).toEqual([
      ['list-keychains', '-d', 'user', '-s'],
    ]);
  });

  test('an existing default is restored before deleting the fixture, and preexisting fixture references are refused', () => {
    const before = { search: ['/owned/prior.keychain-db', '/owned/other.keychain-db'], default: ['/owned/prior.keychain-db'] };
    expect(fixtureKeychainRestoreCommands(before, '/owned/fixture.keychain-db', true)).toEqual([
      ['default-keychain', '-d', 'user', '-s', '/owned/prior.keychain-db'],
      ['delete-keychain', '/owned/fixture.keychain-db'],
      ['list-keychains', '-d', 'user', '-s', '/owned/prior.keychain-db', '/owned/other.keychain-db'],
    ]);
    expect(() => fixtureKeychainRestoreCommands(before, '/owned/prior.keychain-db', true)).toThrow('fixture_keychain_not_fresh');
  });

  test('fresh account cleanup requires the same GUID, UID, private group, and registered home', () => {
    const identity = { guid: 'A38AC39B-5960-4F0C-B02F-C32A4F625B33', uid: 23456, gid: 23456, home: '/private/tmp/fixture/home' };
    const record = parseDirectoryRecord(`GeneratedUID: ${identity.guid}\nUniqueID: ${identity.uid}\nPrimaryGroupID: ${identity.gid}\nNFSHomeDirectory: ${identity.home}\n`);
    expect(ownsFreshAccount(record, identity)).toBe(true);
    for (const key of ['GeneratedUID', 'UniqueID', 'PrimaryGroupID', 'NFSHomeDirectory']) {
      expect(ownsFreshAccount({ ...record, [key]: 'different' }, identity)).toBe(false);
    }
    expect(() => parseDirectoryRecord('UniqueID: 23456\nUniqueID: 501')).toThrow('invalid_directory_record');
  });

  test('user-domain absence requires an explicit matching-domain response, not an arbitrary command failure', () => {
    for (const status of [64, 113]) {
      const absent = classifyUserDomain(23456, { status, stdout: '', stderr: 'Bad request.\nCould not find domain for user uid: 23456\n' });
      expect(absent.state).toBe('absent');
      expect(absent.uid).toBe(23456);
    }
    for (const result of [
      { status: 1, stdout: '', stderr: 'sudo: a password is required' },
      { status: 113, stdout: '', stderr: 'Could not find domain for user uid: 23457' },
      { status: 113, stdout: '', stderr: 'Could not find domain for user gui: 23456' },
      { status: 113, stdout: '', stderr: 'synthetic-private-error' },
      { status: null, stdout: '', stderr: '', error: new Error('synthetic-private-error') },
    ]) expect(classifyUserDomain(23456, result).state).toBe('unavailable');
    expect(() => classifyUserDomain(0, { status: 0, stdout: '', stderr: '' })).toThrow('invalid_fresh_user_domain');
  });

  test('user-domain inspection records only safe state facts and notices an unexpected GUI domain', () => {
    const present = classifyUserDomain(23456, { status: 0, stdout: 'user/23456 = {\n type = user\n synthetic-private-value\n}', stderr: '' });
    expect(present).toMatchObject({ uid: 23456, state: 'present', hasGuiDomain: false, exitCode: 0 });
    expect(JSON.stringify(present)).not.toContain('synthetic-private-value');
    expect(classifyUserDomain(23456, { status: 0, stdout: 'user/23456 = {\n subdomains = { gui/23456 }\n}', stderr: '' }).hasGuiDomain).toBe(true);
    expect(classifyUserDomain(23456, { status: 0, stdout: 'user/23456 = {\n session = Aqua\n}', stderr: '' }).hasGuiDomain).toBe(true);
    expect(classifyUserDomain(23456, { status: 0, stdout: 'user/501 = { }', stderr: '' }).state).toBe('unavailable');
  });

  test('domain structure retains counts and creator correlation, never arbitrary labels or environment values', () => {
    const stdout = `user/23456 = {
\ttype = user
\thandle = 23456
\tactive count = 3
\ton-demand count = 0
\tservice count = 2
\tactive service count = 1
\texternal activation count = 0
\tin-progress bootstraps = 0
\tpended requests = 0
\tcreator = launchctl.4567
\tcreator euid = 0
\tenvironment = {
\t\tsynthetic-private-variable => synthetic-private-value
\t\tservice count = 999
\t}
\tservices = {
\t\t234 0 synthetic-private-service
\t\t0 0 synthetic-private-job
\t}
\tsubdomains = {
\t\tsynthetic-private-child
\t}
\tunmanaged processes = {
\t}
\tendpoints = {}
}`;
    const observation = classifyUserDomain(23456, { status: 0, stdout, stderr: '' }, 4567);
    expect(observation.structure).toMatchObject({ complete: true, type: 'user', handleMatchesUid: true, creator: 'launchctl', creatorIsProbe: true,
      counts: { 'service count': 2, 'active service count': 1, 'creator euid': 0, 'in-progress bootstraps': 0 },
      sectionNonemptyLines: { services: 2, subdomains: 1, 'unmanaged processes': 0, endpoints: 0, jobs: null } });
    expect(JSON.stringify(observation)).not.toContain('synthetic-private');
    expect(JSON.stringify(observation)).not.toContain('4567');
    expect(classifyUserDomain(23456, { status: 0, stdout, stderr: '' }, 4568).structure?.creatorIsProbe).toBe(false);
    expect(classifyUserDomain(23456, { status: 0, stdout, stderr: '' }).structure?.creatorIsProbe).toBeNull();
    expect(classifyUserDomain(23456, { status: 0, stdout: stdout.replace('launchctl.4567', 'synthetic-private-creator.4567'), stderr: '' }, 4567).structure?.creator).toBe('other');
  });

  test('missing, malformed, duplicate, and incomplete domain facts never become empty-baseline evidence', () => {
    const minimal = 'user/23456 = {\n\ttype = user\n\thandle = 23456\n}';
    const observation = classifyUserDomain(23456, { status: 0, stdout: minimal, stderr: '' });
    expect(observation.structure?.counts['service count']).toBeNull();
    expect(observation.structure?.sectionNonemptyLines.services).toBeNull();
    expect(observation.structure?.creatorIsProbe).toBeNull();
    for (const stdout of [minimal.slice(0, -1), minimal.replace('\thandle', '\ttype = user\n\thandle'),
      minimal.replace('\thandle = 23456', '\tservices = {\n\t\tsynthetic-private-service')]) {
      expect(classifyUserDomain(23456, { status: 0, stdout, stderr: '' }).structure?.complete).toBe(false);
    }
    for (const value of ['-1', 'NaN', '1.5', '9007199254740992', 'synthetic-private-value']) {
      const stdout = minimal.replace('\thandle', '\tservice count = ' + value + '\n\thandle');
      expect(classifyUserDomain(23456, { status: 0, stdout, stderr: '' }).structure?.counts['service count']).toBeNull();
    }
  });

  test('known bracketed creator syntax is matched exactly while unsupported spellings remain unknown', () => {
    const fixture = (creator: string) => classifyUserDomain(23456, { status: 0,
      stdout: `user/23456 = {\n\ttype = user\n\tcreator = ${creator}\n}`, stderr: '' }, 4567);
    expect(fixture('launchctl[4567]').structure?.creatorIsProbe).toBe(true);
    expect(fixture('launchctl[4568]').structure?.creatorIsProbe).toBe(false);
    for (const creator of ['launchctl(4567)', 'launchctl[4567] extra', 'other[4567]', 'launchctl[0]', 'launchctl[4567)']) {
      expect(fixture(creator).structure?.creatorIsProbe).toBeNull();
      expect(fixture(creator).structure?.creator).toBe('other');
    }
  });

  test('parent-domain observation extracts only candidate UID membership from complete subdomains', () => {
    for (const [header, target, gui] of [
      ['system', 'user/23456', 'gui/23456'],
      ['com.apple.xpc.launchd.domain.system', 'com.apple.xpc.launchd.domain.user.23456', 'com.apple.xpc.launchd.user.domain.23456.100007.Aqua'],
    ]) {
      const stdout = `${header} = {\n\ttype = system\n\tsubdomains = {\n\t\t${target}\n\t\t${gui}\n\t\tpid/15\n\t}\n}`;
      expect(classifyParentDomain(23456, { status: 0, stdout, stderr: '' })).toMatchObject({ state: 'present', parseStage: 'parsed',
        subdomainCount: 3, matchingUserDomains: 1, matchingGuiDomains: 1, unrecognizedEntries: 0 });
    }
    const stdout = `system = {
\ttype = system
\tenvironment = {
\t\tsynthetic-private-name => user/23456
\t\tsubdomains = {
\t\t\tuser/23456
\t\t}
\t}
\tsubdomains = {
\t\tuser/234560
\t\tgui/501
\t\tpid/123
\t\tsession/100007
\t\tcom.apple.xpc.launchd.domain.pid.synthetic-private-process.23456
\t}
\tservices = {
\t\tsynthetic-private-service-user/23456
\t}
}`;
    const observation = classifyParentDomain(23456, { status: 0, stdout, stderr: '' });
    expect(observation).toMatchObject({ state: 'absent', parseStage: 'parsed', subdomainCount: 5, matchingUserDomains: 0 });
    expect(JSON.stringify(observation)).not.toContain('synthetic-private');
    expect(JSON.stringify(observation)).not.toContain('234560');
  });

  test('parent-domain absence refuses incomplete, missing, duplicate, nested-only, or unknown subdomain output', () => {
    const empty = 'system = {\n\ttype = system\n\tsubdomains = {}\n}';
    expect(classifyParentDomain(23456, { status: 0, stdout: empty, stderr: '' }).state).toBe('absent');
    for (const stdout of [empty.slice(0, -1), empty.replace('system = {', 'user/23456 = {'),
      empty.replace('\tsubdomains = {}\n', ''), empty.replace('\tsubdomains = {}', '\tsubdomains = {}\n\tsubdomains = {}'),
      empty.replace('type = system', 'type = user'),
      empty.replace('\tsubdomains = {}', '\tenvironment = {\n\t\tsubdomains = {}\n\t}'),
      empty.replace('subdomains = {}', 'subdomains = {\n\t\tunknown-private-domain\n\t}'),
      empty.replace('subdomains = {}', 'subdomains = {\n\t\tuser/23456\n\t\tunknown-private-domain\n\t}')]) {
      const observation = classifyParentDomain(23456, { status: 0, stdout, stderr: '' });
      expect(observation.state).toBe('unavailable');
      expect(JSON.stringify(observation)).not.toContain('private-domain');
    }
    expect(classifyParentDomain(23456, { status: 1, stdout: empty, stderr: 'synthetic-private-error' }).state).toBe('unavailable');
    expect(classifyParentDomain(23456, { status: 0, stdout: empty, stderr: '', error: new Error('synthetic-private-error') }).state).toBe('unavailable');
    expect(classifyParentDomain(23456, { status: 0, stdout: empty + ' '.repeat(1024 * 1024), stderr: '' }).parseStage).toBe('oversized');
  });

  test('the registered parent observer queries only the existing system domain under its original bounds', () => {
    const env = { HOME: root, PATH: '/usr/bin:/bin' };
    const observation = inspectParentDomain(23456, performance.now() + 10_000, env,
      ((command: string, args: string[], options: any) => {
        expect(command).toBe('/usr/bin/sudo');
        expect(args).toEqual(['-n', '/bin/launchctl', 'print', 'system']);
        expect(options.env).toBe(env);
        expect(options.maxBuffer).toBe(1024 * 1024);
        expect(Number.isInteger(options.timeout)).toBe(true);
        expect(options.timeout).toBeGreaterThan(0);
        expect(options.timeout).toBeLessThanOrEqual(3_000);
        return { status: 0, stdout: 'system = {\n\ttype = system\n\tsubdomains = {}\n}', stderr: '' };
      }) as typeof spawnSync);
    expect(observation.state).toBe('absent');
    const never = (() => { throw new Error('must_not_spawn'); }) as typeof spawnSync;
    expect(() => inspectParentDomain(501, performance.now() + 10_000, {}, never)).toThrow('invalid_fresh_user_domain');
    for (const deadline of [0, NaN, Infinity]) expect(() => inspectParentDomain(23456, deadline, {}, never)).toThrow('fresh_launcher_deadline');
  });

  test('the registered UID observer filters numeric global ps rows without resolving an unregistered account', () => {
    const env = { HOME: root, PATH: '/usr/bin:/bin' };
    const observation = inspectUidProcesses(23456, performance.now() + 10_000, env,
      ((command: string, args: string[], options: any) => {
        expect(command).toBe('/bin/ps');
        expect(args).toEqual(['-axo', 'uid=,pid=,ppid=,state=,ucomm=']);
        expect(options.env).toBe(env);
        expect(options.maxBuffer).toBe(128 * 1024);
        expect(Number.isInteger(options.timeout)).toBe(true);
        expect(options.timeout).toBeGreaterThan(0);
        expect(options.timeout).toBeLessThanOrEqual(2_000);
        return { status: 0, stdout: '501 300 1 S synthetic-private-name\n23456 400 1 S distnoted\n', stderr: '' };
      }) as typeof spawnSync);
    expect(observation).toMatchObject({ available: true, count: 1, processes: [{ pid: 400, ppid: 1, state: 'S', basename: 'distnoted' }] });
    expect(JSON.stringify(observation)).not.toContain('synthetic-private');
    expect(inspectUidProcesses(23456, performance.now() + 10_000, {}, (() => ({ status: 0,
      stdout: '501 300 1 S synthetic-private-name\n', stderr: '' })) as typeof spawnSync)).toMatchObject({ available: true, count: 0, processes: [] });
    for (const result of [
      { status: 1, stdout: '', stderr: '' }, { status: 0, stdout: '', stderr: '' },
      { status: 0, stdout: 'truncated-private-row', stderr: '' },
      { status: null, stdout: null, stderr: null, error: new Error('synthetic-private-error') },
    ]) expect(inspectUidProcesses(23456, performance.now() + 10_000, {}, (() => result) as typeof spawnSync)).toEqual({ available: false });
  });

  test('numeric UID process filtering runs through the real global process table', () => {
    const observation = inspectUidProcesses(23456, performance.now() + 10_000, { HOME: root, PATH: '/usr/bin:/bin' });
    expect(observation.available).toBe(true);
    expect('count' in observation).toBe(true);
  });

  test('the registered domain probe binds its creator check to the shell exec PID and bounds the query', () => {
    const env = { PATH: '/usr/bin:/bin', HOME: root };
    let called = false;
    const observation = inspectUserDomain(23456, performance.now() + 10_000, env, ((command: string, args: string[], options: any) => {
      called = true;
      expect(command).toBe('/usr/bin/sudo');
      expect(args).toEqual(['-n', '/bin/sh', '-c', 'printf "GSTACK_DIA_DOMAIN_PROBE_PID=%s\\n" "$$"; exec /bin/launchctl print "$1"',
        'gstack-dia-domain-probe', 'user/23456']);
      expect(options.env).toBe(env);
      expect(options.timeout).toBeGreaterThan(0);
      expect(options.timeout).toBeLessThanOrEqual(3_000);
      expect(Number.isInteger(options.timeout)).toBe(true);
      expect(options.maxBuffer).toBe(1024 * 1024);
      return { status: 0, stdout: 'GSTACK_DIA_DOMAIN_PROBE_PID=4567\nuser/23456 = {\n\ttype = user\n\tcreator = launchctl.4567\n}', stderr: '' };
    }) as typeof spawnSync);
    expect(called).toBe(true);
    expect(observation.state).toBe('present');
    expect(observation.structure?.creatorIsProbe).toBe(true);
    expect(JSON.stringify(observation)).not.toContain('GSTACK_DIA_DOMAIN_PROBE_PID');
  });

  test('domain probe failures preserve unknown state instead of manufacturing absence or creator ownership', () => {
    for (const result of [
      { status: 0, stdout: 'user/23456 = {\n\ttype = user\n}', stderr: '' },
      { status: 0, stdout: 'GSTACK_DIA_DOMAIN_PROBE_PID=9007199254740992\nuser/23456 = {\n\ttype = user\n}', stderr: '' },
      { status: 113, stdout: '', stderr: 'Could not find domain for user uid: 23456' },
      { status: null, stdout: null, stderr: null, error: new Error('synthetic-private-error') },
    ]) {
      const observation = inspectUserDomain(23456, performance.now() + 10_000, {}, (() => result) as typeof spawnSync);
      expect(observation.state).toBe('unavailable');
      expect(observation.structure).toBeUndefined();
      expect(JSON.stringify(observation)).not.toContain('synthetic-private');
    }
    expect(inspectUserDomain(23456, performance.now() + 10_000, {}, (() => ({ status: 113,
      stdout: 'GSTACK_DIA_DOMAIN_PROBE_PID=4567\n', stderr: 'Could not find domain for user uid: 23456' })) as typeof spawnSync).state).toBe('absent');
    const never = (() => { throw new Error('must_not_spawn'); }) as typeof spawnSync;
    expect(() => inspectUserDomain(0, performance.now() + 10_000, {}, never)).toThrow('invalid_fresh_user_domain');
    for (const deadline of [0, NaN, Infinity]) expect(() => inspectUserDomain(23456, deadline, {}, never)).toThrow('fresh_launcher_deadline');
  });

  test('the domain probe PID protocol survives real shell exec without logging the PID or child output', () => {
    const fixture = path.join(root, 'domain-probe.cjs');
    writeFileSync(fixture, 'process.stdout.write("user/23456 = {\\n\\ttype = user\\n\\tcreator = launchctl." + process.pid + "\\n}");');
    const observation = inspectUserDomain(23456, performance.now() + 10_000, { PATH: '/usr/bin:/bin', HOME: root },
      ((_command: string, args: string[], options: any) => spawnSync('/bin/sh', ['-c',
        args[3].replace('/bin/launchctl print "$1"', '"$1" "$2"'), args[4], process.execPath, fixture],
      { ...options, timeout: 3_000 })) as typeof spawnSync);
    expect(observation.state).toBe('present');
    expect(observation.structure?.creatorIsProbe).toBe(true);
    expect(observation.structure?.complete).toBe(true);
    expect(JSON.stringify(observation)).not.toContain('GSTACK_DIA_DOMAIN_PROBE_PID');
  });

  test('user-domain teardown is bound to the new account and its pre-creation absence proof', () => {
    const account = { guid: 'A38AC39B-5960-4F0C-B02F-C32A4F625B33', uid: 23456, gid: 23456, home: '/private/tmp/dn-fixture/home' };
    const record = { GeneratedUID: account.guid, UniqueID: '23456', PrimaryGroupID: '23456', NFSHomeDirectory: account.home };
    const proof = classifyParentDomain(23456, { status: 0, stdout: 'system = {\n\ttype = system\n\tsubdomains = {}\n}', stderr: '' });
    const current = classifyParentDomain(23456, { status: 0, stdout: 'system = {\n\ttype = system\n\tsubdomains = {\n\t\tuser/23456\n\t}\n}', stderr: '' });
    expect(ownedUserDomainTarget(record, account, proof, current, 501)).toBe('user/23456');
    expect(ownedUserDomainTarget(record, account, proof, proof, 501)).toBeNull();
    for (const key of ['GeneratedUID', 'UniqueID', 'PrimaryGroupID', 'NFSHomeDirectory']) {
      expect(() => ownedUserDomainTarget({ ...record, [key]: 'changed' }, account, proof, current, 501)).toThrow('fresh_user_domain_ownership_unconfirmed');
    }
    expect(() => ownedUserDomainTarget(record, account, undefined, current, 501)).toThrow('fresh_user_domain_ownership_unconfirmed');
    expect(() => ownedUserDomainTarget(record, account, { ...proof, state: 'present' }, current, 501)).toThrow('fresh_user_domain_ownership_unconfirmed');
    expect(() => ownedUserDomainTarget(record, account, { ...proof, uid: 23457 }, current, 501)).toThrow('fresh_user_domain_ownership_unconfirmed');
    expect(() => ownedUserDomainTarget(record, account, proof, current, 23456)).toThrow('fresh_user_domain_ownership_unconfirmed');
    expect(() => ownedUserDomainTarget(record, account, proof, current, NaN)).toThrow('fresh_user_domain_ownership_unconfirmed');
    for (const changed of [{ ...current, matchingGuiDomains: 1 }, { ...current, uid: 23457 }, { ...current, state: 'unavailable' as const },
      { ...current, duplicateEntries: 1 }, { ...current, matchingUserDomains: 2 }, { ...current, parseStage: 'missing_subdomains' },
      { ...current, unrecognizedEntries: 1 }]) {
      expect(() => ownedUserDomainTarget(record, account, proof, changed, 501)).toThrow('fresh_user_domain_ownership_unconfirmed');
    }
  });

  test('duplicated native subdomain entries and equivalent aliases never authorize teardown or absence', () => {
    for (const entries of [
      ['user/23456', 'user/23456'], ['user/23456', 'com.apple.xpc.launchd.domain.user.23456'],
      ['user/23456', 'gui/23456', 'gui/23456'], ['user/501', 'user/501'],
      ['user/23456', 'pid/22', 'com.apple.xpc.launchd.domain.pid.synthetic-private-process.22'],
    ]) {
      const observation = classifyParentDomain(23456, { status: 0,
        stdout: 'system = {\n\ttype = system\n\tsubdomains = {\n' + entries.map(entry => '\t\t' + entry).join('\n') + '\n\t}\n}', stderr: '' });
      expect(observation.duplicateEntries).toBe(1);
      expect(observation.parseStage).toBe('duplicate_subdomain');
      expect(observation.state).toBe('unavailable');
      expect(passiveUserDomainState(observation, 23456)).toBe('unavailable');
    }
  });

  test('passive absence and presence require consistent complete facts with no GUI association', () => {
    const absent = classifyParentDomain(23456, { status: 0, stdout: 'system = {\n\ttype = system\n\tsubdomains = {}\n}', stderr: '' });
    expect(passiveUserDomainState(absent, 23456)).toBe('absent');
    for (const changed of [undefined, { ...absent, uid: 23457 }, { ...absent, matchingUserDomains: 1 },
      { ...absent, matchingGuiDomains: 1 }, { ...absent, exitCode: 1 }, { ...absent, duplicateEntries: 1 },
      { ...absent, unrecognizedEntries: 1 }, { ...absent, state: 'present' as const }]) {
      expect(passiveUserDomainState(changed, 23456)).toBe('unavailable');
    }
    const gui = classifyParentDomain(23456, { status: 0,
      stdout: 'system = {\n\ttype = system\n\tsubdomains = {\n\t\tuser/23456\n\t\tgui/23456\n\t}\n}', stderr: '' });
    expect(passiveUserDomainState(gui, 23456)).toBe('unavailable');
    const oldTargetObservation = classifyUserDomain(23456, { status: 113, stdout: '', stderr: 'Could not find domain for user uid: 23456' });
    expect(passiveUserDomainState(oldTargetObservation as any, 23456)).toBe('unavailable');
  });

  test('directory UID inventory retains occupied candidate IDs and refuses malformed or empty listings', () => {
    expect([...parseDirectoryIds('root 0\nfixture 20000\nnobody -2\nother fixture 20001  \n')]).toEqual([0, 20000, -2, 20001]);
    for (const value of ['', 'malformed', 'root 0\nfixture unknown\n', 'root 0\nfixture 9007199254740992\n']) {
      expect(() => parseDirectoryIds(value)).toThrow();
    }
  });

  test('normal qualification never invokes the materializing target-domain diagnostic', () => {
    const implementation = runFreshAccountQualification.toString();
    expect(implementation).toContain('inspectParentDomain');
    expect(implementation).toContain('passiveUserDomainState');
    expect(implementation).not.toMatch(/inspectUserDomain|probeUserDomain|classifyUserDomain/);
    expect(implementation).not.toMatch(/['"]print['"],\s*['"](?:user|gui)\//);
  });

  test('launchd receives a one-shot fresh-user security session without an Aqua or auto-login workaround', () => {
    const account: any = { label: 'ai.gstack.dia.fixture', account: 'gsdiafixture', bun: '/private/tmp/fixture/bin/bun',
      snapshot: '/private/tmp/fixture/repo', configFile: '/private/tmp/fixture/account.json', environment: { HOME: '/private/tmp/fixture/home', CI: 'true' } };
    const definition = freshLaunchDefinition(account);
    expect(definition.UserName).toBe(account.account);
    expect(definition.GroupName).toBe(account.account);
    expect(definition.SessionCreate).toBe(true);
    expect(definition.RunAtLoad).toBe(true);
    expect(definition.KeepAlive).toBe(false);
    expect(definition.Umask).toBe(63);
    expect(definition.ProgramArguments[0]).toBe(account.bun);
    expect(definition.ProgramArguments).toContain('--fresh-worker');
    expect(definition.StandardOutPath).toBe('/dev/null');
    expect(definition.StandardErrorPath).toBe('/dev/null');
    expect(JSON.stringify(definition)).not.toMatch(/Aqua|autoLogin|LoginWindow|GITHUB_TOKEN/);
  });

  test('service cleanup binds the exact system label, executable, user, and private group', () => {
    const owner = { label: 'ai.gstack.dia.fixture', bun: '/private/tmp/fixture/bin/bun', account: 'gsdiafixture' };
    const state = `system/${owner.label} = {\n program = ${owner.bun}\n username = ${owner.account}\n group = ${owner.account}\n}`;
    expect(ownsLaunchService(state, owner)).toBe(true);
    for (const replacement of [state.replace('system/', 'gui/501/'), state.replace(owner.label, 'unrelated'),
      state.replace(owner.bun, '/unrelated/bun'), state.replace('username = gsdiafixture', 'username = runner'),
      state.replace('group = gsdiafixture', 'group = staff')]) expect(ownsLaunchService(replacement, owner)).toBe(false);
  });

  test('the fresh-account launcher refuses this non-authorized invocation without privileged work', () => {
    const launcher = path.resolve(import.meta.dir, '../../.github/scripts/run-dia-native-qualification.ts');
    const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros', `--config=${process.platform === 'win32' ? 'NUL' : '/dev/null'}`, launcher], {
      cwd: root, env: { HOME: root, PATH: path.dirname(process.execPath) }, encoding: 'utf8', timeout: 10_000,
    });
    expect(result.status).toBe(2);
    expect(result.stderr).toBe('');
    expect(JSON.parse(result.stdout).reason).toBe('fresh_account_launcher_preflight_failed');
  });

  for (const shape of ['normal', 'safe-link', 'traversal', 'absolute', 'escape-link', 'symlink-parent', 'symlink-dotdot', 'hardlink', 'case-collision', 'unicode-collision', 'device']) {
    test(`archive preflight classifies ${shape} before extraction`, () => {
      const python = Bun.which('python3');
      if (!python) throw new Error('Python 3 is required for archive boundary tests');
      const archive = path.join(root, shape + '.tar');
      const create = spawnSync(python, ['-I', '-c', `
import io, sys, tarfile
shape, file = sys.argv[1:]
with tarfile.open(file, 'w') as out:
    def entry(name, kind=tarfile.REGTYPE, link=''):
        item = tarfile.TarInfo(name); item.type = kind; item.linkname = link
        if kind == tarfile.REGTYPE:
            item.size = 1; out.addfile(item, io.BytesIO(b'x'))
        else: out.addfile(item)
    if shape == 'normal': entry('src/file.ts')
    elif shape == 'safe-link': entry('target'); entry('link', tarfile.SYMTYPE, 'target')
    elif shape == 'traversal': entry('../outside')
    elif shape == 'absolute': entry('/outside')
    elif shape == 'escape-link': entry('link', tarfile.SYMTYPE, '../outside')
    elif shape == 'symlink-parent': entry('link', tarfile.SYMTYPE, 'target'); entry('link/child')
    elif shape == 'symlink-dotdot': entry('b', tarfile.SYMTYPE, '.'); entry('a/link', tarfile.SYMTYPE, '../b/..')
    elif shape == 'hardlink': entry('target'); entry('link', tarfile.LNKTYPE, 'target')
    elif shape == 'case-collision': entry('File'); entry('file')
    elif shape == 'unicode-collision': entry('Caf' + chr(233)); entry('Cafe' + chr(769))
    elif shape == 'device': entry('device', tarfile.CHRTYPE)
`, shape, archive], { encoding: 'utf8', timeout: 10_000 });
      expect(create.status).toBe(0);
      const checked = spawnSync(python, ['-I', '-c', ARCHIVE_CHECK, archive], { encoding: 'utf8', timeout: 10_000 });
      expect(checked.status).toBe(['normal', 'safe-link'].includes(shape) ? 0 : 2);
      expect(JSON.parse(checked.stdout).valid).toBe(['normal', 'safe-link'].includes(shape));
      expect(checked.stderr).toBe('');
    });
  }

  test('receipt collection rejects symlinks and an unrelated owner without printing content', () => {
    const python = Bun.which('python3');
    if (!python) throw new Error('Python 3 is required for receipt boundary tests');
    const directory = realpathSync(mkdtempSync(path.join(root, 'receipts-')));
    const file = path.join(directory, 'receipt.json');
    writeFileSync(file, JSON.stringify({ status: 'incomplete', reason: 'synthetic_fixture' }), { mode: 0o600 });
    chmodSync(file, 0o600);
    const uid = process.getuid!();
    const read = (selected: string, owner: number) => spawnSync(python, ['-I', '-c', PRIVATE_RECEIPT_READ, selected, String(owner), directory], {
      encoding: 'utf8', timeout: 10_000,
    });
    const valid = read(file, uid);
    expect(valid.status).toBe(0);
    expect(JSON.parse(valid.stdout).status).toBe('incomplete');
    const wrong = read(file, uid + 1);
    expect(wrong.status).toBe(2);
    expect(wrong.stdout).toBe('');
    const link = path.join(directory, 'linked.json');
    symlinkSync(file, link);
    const linked = read(link, uid);
    expect(linked.status).toBe(2);
    expect(linked.stdout).toBe('');
  });

  test('receipt collection rejects linked ancestors and incomplete JSON without disclosing content', () => {
    const python = Bun.which('python3');
    if (!python) throw new Error('Python 3 is required for receipt boundary tests');
    const directory = realpathSync(mkdtempSync(path.join(root, 'receipt-ancestors-')));
    const nested = path.join(directory, 'nested');
    mkdirSync(nested, { mode: 0o700 });
    const file = path.join(nested, 'receipt.json');
    writePrivateReceipt(file, { status: 'incomplete' });
    const linked = path.join(directory, 'linked');
    symlinkSync(nested, linked, 'dir');
    const read = (selected: string) => spawnSync(python, ['-I', '-c', PRIVATE_RECEIPT_READ, selected, String(process.getuid!()), directory], {
      encoding: 'utf8', timeout: 3_000,
    });
    expect(read(file).status).toBe(0);
    const rejected = read(path.join(linked, 'receipt.json'));
    expect(rejected.status).toBe(2);
    expect(rejected.stdout).toBe('');
    writeFileSync(file, '{"synthetic-private-value":');
    const partial = read(file);
    expect(partial.status).toBe(2);
    expect(partial.stdout).toBe('');
  });

  test('receipt publication is private, atomic, and refuses unintended overwrites or symlink targets', () => {
    const directory = realpathSync(mkdtempSync(path.join(root, 'atomic-receipt-')));
    const file = path.join(directory, 'receipt.json');
    writePrivateReceipt(file, { status: 'incomplete', phase: 'first' });
    expect(lstatSync(file).mode & 0o777).toBe(0o600);
    expect(() => writePrivateReceipt(file, { status: 'passed' })).toThrow();
    expect(JSON.parse(readFileSync(file, 'utf8')).phase).toBe('first');
    writePrivateReceipt(file, { status: 'incomplete', phase: 'second' }, true);
    expect(JSON.parse(readFileSync(file, 'utf8')).phase).toBe('second');
    const link = path.join(directory, 'linked.json');
    symlinkSync(file, link);
    expect(() => writePrivateReceipt(link, { status: 'passed' }, true)).toThrow('unsafe_receipt_replacement');
    expect(JSON.parse(readFileSync(file, 'utf8')).phase).toBe('second');
    expect(readdirSync(directory).some(name => name.startsWith('.dia-receipt-'))).toBe(false);
  });

  test('an atomic owner-checked diagnostic receipt is readable while its producer is still alive', async () => {
    const python = Bun.which('python3');
    if (!python) throw new Error('Python 3 is required for receipt boundary tests');
    const directory = realpathSync(mkdtempSync(path.join(root, 'live-receipt-')));
    const file = path.join(directory, 'receipt.json');
    const module = pathToFileURL(path.resolve(import.meta.dir, '../../.github/scripts/qualify-dia-macos.ts')).href;
    const child = Bun.spawn([process.execPath, '--no-env-file', '--no-install', '--no-macros', '--config=/dev/null', '-e', `
      const { writePrivateReceipt } = await import(${JSON.stringify(module)});
      writePrivateReceipt(${JSON.stringify(file)}, { status: 'incomplete', reason: 'worker_diagnostic', cleanup: { complete: false } });
      console.log('ready');
      setInterval(() => {}, 1000);
    `], { cwd: directory, env: { HOME: directory, PATH: path.dirname(process.execPath) }, stdout: 'pipe', stderr: 'pipe' });
    try {
      const reader = child.stdout.getReader();
      expect(new TextDecoder().decode((await reader.read()).value)).toContain('ready');
      reader.releaseLock();
      expect(child.exitCode).toBeNull();
      const result = spawnSync(python, ['-I', '-c', PRIVATE_RECEIPT_READ, file, String(process.getuid!()), directory], {
        encoding: 'utf8', timeout: 3_000,
      });
      expect(result.status).toBe(0);
      expect(JSON.parse(result.stdout)).toEqual({ status: 'incomplete', reason: 'worker_diagnostic', cleanup: { complete: false } });
      expect(child.exitCode).toBeNull();
    } finally {
      child.kill();
      await child.exited;
    }
  });

  test('UID process diagnostics preserve zombie/service/browser distinctions without argv or arbitrary names', () => {
    const facts = uidProcessFacts('20000 301 1 Ss cfprefsd\n20000 302 1 Z bun\n20000 303 301 R Google Chrome for Testing\n20000 304 1 S synthetic-private-value\n501 999 1 S security\n', 20000);
    expect(facts).toEqual({ available: true, count: 4, zombies: 1, live: 3, truncated: false, processes: [
      { pid: 301, ppid: 1, state: 'S', basename: 'cfprefsd' }, { pid: 302, ppid: 1, state: 'Z', basename: 'bun' },
      { pid: 303, ppid: 301, state: 'R', basename: 'Google Chrome for Testing' }, { pid: 304, ppid: 1, state: 'S', basename: 'other' },
    ] });
    expect(JSON.stringify(facts)).not.toContain('synthetic-private-value');
    expect(JSON.stringify(facts)).not.toContain('999');
    expect(uidProcessFacts('20000 401 1 S cfprefsd\n', 20000).processes[0].pid).toBe(401);
    expect(uidProcessFacts('20000 402 1 Z+ bun\n', 20000)).toMatchObject({ count: 1, zombies: 1, live: 0 });
    expect(() => uidProcessFacts('malformed synthetic-private-value', 20000)).toThrow('invalid_uid_process_snapshot');
    expect(uidProcessFacts(Array.from({ length: 80 }, (_, index) => `20000 ${1000 + index} 1 S bun`).join('\n'), 20000))
      .toMatchObject({ count: 80, truncated: true });
    expect(uidProcessFacts(Array.from({ length: 80 }, (_, index) => `20000 ${1000 + index} 1 S bun`).join('\n'), 20000).processes).toHaveLength(64);
  });

  test('captured passing inner receipts cannot qualify a run with incomplete cleanup', () => {
    const cleanup = { serviceStopped: true, userDomainStopped: true, userProcessesStopped: true, accountRemoved: true, groupRemoved: true, stagingRemoved: true };
    expect(freshQualificationPassed(0, 'passed', 'passed', cleanup)).toBe(true);
    for (const key of Object.keys(cleanup)) expect(freshQualificationPassed(0, 'passed', 'passed', { ...cleanup, [key]: false })).toBe(false);
    expect(freshQualificationPassed(0, 'passed', 'passed', {})).toBe(false);
    expect(freshQualificationPassed(2, 'passed', 'passed', cleanup)).toBe(false);
    expect(freshQualificationPassed(0, 'incomplete', 'passed', cleanup)).toBe(false);
  });

  test('the registered spawn observer records the actual owned child and closes launch admission', async () => {
    const profile = path.join(root, 'profile');
    const childProcess = require('node:child_process');
    const original = childProcess.spawn;
    const observer = observeBrowserLaunches(new Map([[process.execPath, profile]]));
    const args = ['--no-env-file', '--no-install', '-e', 'process.exit(0)', '--', '--remote-debugging-pipe', '--user-data-dir=' + profile];
    const options = { cwd: root, detached: true, shell: false, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'],
      env: { PATH: path.dirname(process.execPath), HOME: root, ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}) } };
    try {
      const child = childProcess.spawn(process.execPath, args, options);
      const code = await new Promise(resolve => child.once('close', resolve));
      expect(code).toBe(0);
      expect(observer.children).toHaveLength(1);
      expect(observer.children[0].process).toBe(child);
      expect(observer.children[0].pid).toBe(child.pid);
      observer.stop();
      expect(() => childProcess.spawn(process.execPath, args, options)).toThrow('browser_launch_policy_rejected');
      expect(observer.children).toHaveLength(1);
    } finally {
      observer.restore();
    }
    expect(childProcess.spawn).toBe(original);
  });

  test('the owned spawn stderr observer preserves the consumer stream and removes only its own listeners', async () => {
    const childProcess = require('node:child_process');
    const original = childProcess.spawn;
    const profile = path.join(root, 'stderr-observer-profile');
    const observer = observeBrowserLaunches(new Map([[process.execPath, profile]]));
    const text = 'DevTools remote debugging requires a non-default data directory.\nsynthetic-private-value\n';
    try {
      const child = childProcess.spawn(process.execPath, ['--no-env-file', '--no-install', '-e',
        `process.stderr.write(${JSON.stringify(text)})`, '--', '--remote-debugging-pipe', '--user-data-dir=' + profile], {
        detached: true, shell: false, stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'], env: { HOME: root, PATH: path.dirname(process.execPath) },
      });
      const chunks: Buffer[] = [];
      const consumer = (chunk: Buffer) => { chunks.push(chunk); };
      child.stderr.on('data', consumer);
      const code = await new Promise(resolve => child.once('close', resolve));
      expect(code).toBe(0);
      expect(Buffer.concat(chunks).toString()).toBe(text);
      const facts = browserStderrFacts(observer.children);
      expect(facts).toHaveLength(1);
      expect(facts[0]).toMatchObject({ available: true, bytesSeen: Buffer.byteLength(text), ended: true,
        reasonCounts: { default_profile_policy: 1 } });
      expect(JSON.stringify(facts)).not.toContain('synthetic-private');
      observer.restore();
      expect(child.stderr.listeners('data')).toContain(consumer);
      expect(childProcess.spawn).toBe(original);
    } finally { observer.restore(); }
  });

  test('an owned killed child is joined before proving its process group absent', async () => {
    const childProcess = require('node:child_process');
    const profile = path.join(root, 'reaping-profile');
    const observer = observeBrowserLaunches(new Map([[process.execPath, profile]]));
    let timer: ReturnType<typeof setTimeout> | undefined;
    try {
      const child = childProcess.spawn(process.execPath, ['--no-env-file', '--no-install', '-e',
        'process.stdout.write("ready\\n"); setInterval(() => {}, 1000)', '--', '--remote-debugging-pipe', '--user-data-dir=' + profile], {
        detached: true, shell: false, stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'], env: { HOME: root, PATH: path.dirname(process.execPath) },
      });
      await Promise.race([new Promise(resolve => child.stdout.once('data', resolve)), new Promise((_, reject) => {
        timer = setTimeout(() => reject(new Error('fixture_startup_timeout')), 3000);
      })]);
      clearTimeout(timer);
      const owned = observer.children[0];
      expect(owned.closeObserved).toBe(false);
      const until = performance.now() + 5_000;
      const facts: Record<string, any> = { signalSent: false, absenceConfirmed: false };
      await stopOwnedBrowserGroup(owned, until, facts);
      expect(owned.closeObserved).toBe(true);
      expect(facts).toMatchObject({ signalSent: true, childCloseObserved: true, absenceConfirmed: true });
      let absent = false;
      while (performance.now() < until) {
        try { process.kill(-owned.pid, 0); }
        catch (error: any) { if (error.code === 'ESRCH') { absent = true; break; } throw error; }
        await Bun.sleep(10);
      }
      expect(absent).toBe(true);
      expect(browserRootFacts(observer.children)[0]).toMatchObject({ closeObserved: true, signal: 'SIGKILL' });
    } finally {
      clearTimeout(timer);
      for (const owned of observer.children) {
        if (owned.closeObserved) continue;
        try { process.kill(-owned.pid, 'SIGKILL'); } catch {}
        await joinOwnedBrowserClose(owned, performance.now() + 5_000);
      }
      observer.restore();
    }
  });

  test('the pinned Playwright launch is captured with the observer installed after importing Playwright', async () => {
    const { chromium } = await import('playwright');
    expect(require('playwright/package.json').version).toBe('1.62.1');
    const executable = realpathSync(chromium.executablePath());
    const profile = path.join(root, 'playwright-profile');
    const observer = observeBrowserLaunches(new Map([[executable, profile]]));
    let context: Awaited<ReturnType<typeof chromium.launchPersistentContext>> | undefined;
    try {
      const nativeOptions = nativeDiaLaunchOptions(executable, {
        HOME: root, PATH: path.dirname(process.execPath) + ':/usr/bin:/bin:/usr/sbin:/sbin',
        ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
      });
      expect(nativeOptions.chromiumSandbox).toBe(true);
      context = await chromium.launchPersistentContext(profile, nativeOptions);
      expect(observer.children).toHaveLength(1);
      expect(observer.children[0].executable).toBe(executable);
      expect(observer.children[0].pid).toBeGreaterThan(1);
      expect(browserRootFacts(observer.children)).toEqual([{ pid: observer.children[0].pid, exitCode: null, closeObserved: false, signal: null }]);
      expect(browserStartupFacts(context.pages().map(page => page.url()), 'http://127.0.0.1:8123').allowed).toBe(true);
      expect(browserStderrFacts(observer.children)[0].available).toBe(true);
      expect(browserStderrFacts(observer.children)[0].bytesInspected).toBeLessThanOrEqual(65_536);
      expect(observer.attempts).toHaveLength(1);
      expect(observer.attempts[0]).toEqual({ admissionOpen: true, argumentsArray: true, pipeFlag: true, profileArgumentCount: 1,
        expectedProfile: true, detached: true, shellDisabled: true, stdioCount: 5, extraPipeDescriptors: true,
        headlessFlag: true, blankStartupArgument: true, tcpDebuggingFlag: false, mockKeychainFlag: false,
        passwordStoreFlag: false, firstRunSuppressed: false, sandboxRequired: process.platform === 'darwin', sandboxDisablingFlag: false });
      expect(JSON.stringify(observer.attempts)).not.toContain(executable);
      expect(JSON.stringify(observer.attempts)).not.toContain(profile);
      const page = context.pages()[0] ?? await context.newPage();
      await page.setContent('<div id="fixture">isolated browser smoke</div>');
      expect(await page.locator('#fixture').innerText()).toBe('isolated browser smoke');
      await context.close();
      context = undefined;
      expect(observer.children[0].process.exitCode !== null || observer.children[0].process.signalCode !== null).toBe(true);
    } finally {
      observer.stop();
      await context?.close();
      observer.restore();
    }
  }, 40_000);

  for (const forbidden of ['--remote-debugging-port=9222', '--use-mock-keychain', '--password-store=basic', '--no-first-run']) {
    test(`the actual spawn callback rejects ${forbidden} before process creation`, () => {
      const profile = path.join(root, 'profile');
      const childProcess = require('node:child_process');
      const observer = observeBrowserLaunches(new Map([[process.execPath, profile]]));
      try {
        expect(() => childProcess.spawn(process.execPath, ['--remote-debugging-pipe', '--user-data-dir=' + profile, forbidden],
          { detached: true, shell: false, stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'] })).toThrow('browser_launch_policy_rejected');
        expect(observer.children).toHaveLength(0);
      } finally { observer.restore(); }
    });
  }

  test('the spawn callback rejects an unowned profile, shell expansion, and a shared process group', () => {
    const profile = path.join(root, 'profile');
    const childProcess = require('node:child_process');
    const observer = observeBrowserLaunches(new Map([[process.execPath, profile]]));
    try {
      for (const [selected, detached, shell] of [[path.join(root, 'other'), true, false], [profile, false, false], [profile, true, true]]) {
        expect(() => childProcess.spawn(process.execPath, ['--remote-debugging-pipe', '--user-data-dir=' + selected], { detached, shell, stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'] }))
          .toThrow('browser_launch_policy_rejected');
      }
      expect(() => childProcess.spawn(process.execPath, ['--remote-debugging-pipe', '--user-data-dir=' + profile, '--user-data-dir=' + path.join(root, 'other')],
        { detached: true, shell: false, stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'] })).toThrow('browser_launch_policy_rejected');
      expect(() => childProcess.spawn(process.execPath, ['--remote-debugging-pipe', '--user-data-dir=' + profile],
        { detached: true, shell: false, stdio: 'inherit' })).toThrow('browser_launch_policy_rejected');
      expect(observer.children).toHaveLength(0);
    } finally { observer.restore(); }
  });
});