fix: surface bounded scan and navigation failures

.github/workflows/test.yml

@@ -3,29 +3,31 @@ name: Test
 on:
   push:
     branches: [main]
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      # Content-checked by contract tests (vitest + cargo test) — must still run CI.
-      - "!docs/doctoring/release-artifact-provenance.md"
-      - "!docs/doctoring/tauri-content-security-policy.md"
-      - "!docs/doctoring/model-artifact-integrity.md"
-      - "!docs/doctoring/model-load-handle-binding.md"
-      - "!docs/development/icloud-local-eviction-batch.md"
-      - "!docs/architecture/goals/cloud-offload-goal.json"
-      - "!CHANGELOG.md"
+    paths:
+      - "**"
+      - "!docs/**"
+      - "!*.md"
+      # GitHub supports re-inclusion only with ordered positive patterns under `paths`.
+      - "docs/doctoring/release-artifact-provenance.md"
+      - "docs/doctoring/tauri-content-security-policy.md"
+      - "docs/doctoring/model-artifact-integrity.md"
+      - "docs/doctoring/model-load-handle-binding.md"
+      - "docs/development/icloud-local-eviction-batch.md"
+      - "docs/architecture/goals/cloud-offload-goal.json"
+      - "CHANGELOG.md"
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      # Content-checked by contract tests (vitest + cargo test) — must still run CI.
-      - "!docs/doctoring/release-artifact-provenance.md"
-      - "!docs/doctoring/tauri-content-security-policy.md"
-      - "!docs/doctoring/model-artifact-integrity.md"
-      - "!docs/doctoring/model-load-handle-binding.md"
-      - "!docs/development/icloud-local-eviction-batch.md"
-      - "!docs/architecture/goals/cloud-offload-goal.json"
-      - "!CHANGELOG.md"
+    paths:
+      - "**"
+      - "!docs/**"
+      - "!*.md"
+      # GitHub supports re-inclusion only with ordered positive patterns under `paths`.
+      - "docs/doctoring/release-artifact-provenance.md"
+      - "docs/doctoring/tauri-content-security-policy.md"
+      - "docs/doctoring/model-artifact-integrity.md"
+      - "docs/doctoring/model-load-handle-binding.md"
+      - "docs/development/icloud-local-eviction-batch.md"
+      - "docs/architecture/goals/cloud-offload-goal.json"
+      - "CHANGELOG.md"
 
 permissions:
   contents: read
@@ -49,7 +51,12 @@ jobs:
           persist-credentials: false
       - name: Install Tauri system deps
         run: |
-          sudo apt-get update
+          for source_file in /etc/apt/sources.list.d/*; do
+            if [[ -f "$source_file" ]] && grep -q 'dl.google.com/linux/chrome' "$source_file"; then
+              sudo rm -f "$source_file"
+            fi
+          done
+          sudo apt-get -o Acquire::Retries=3 update
           sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev lsof
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
@@ -80,9 +87,34 @@ jobs:
       - run: npm test
       - run: npm run build
 
+  macos-cache-cleanup:
+    runs-on: macos-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          workspaces: src-tauri
+          cache-targets: false
+      - name: macOS cache cleanup regressions when owner source is present
+        env:
+          TMPDIR: ${{ runner.temp }}
+        run: |
+          for test_name in cache_cleanup_corepack_scope cache_cleanup_cli_permanent_gradle generated_cache_staged_activity; do
+            if [[ -f "src-tauri/tests/${test_name}.rs" ]]; then
+              cargo test --manifest-path src-tauri/Cargo.toml --test "$test_name"
+            else
+              printf 'SKIP %s: owner test source absent; no runtime regression executed\n' "$test_name"
+            fi
+          done
+
   windows-home-resolution:
     runs-on: windows-latest
-    timeout-minutes: 10
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -95,6 +127,26 @@ jobs:
           New-Item -ItemType Directory -Force target | Out-Null
           rustc --edition=2021 --test src-tauri/tests/home_resolution_contract.rs -o target/home-resolution-contract.exe
           & .\target\home-resolution-contract.exe
+      - name: Windows agent-state regression when owner source is present
+        shell: pwsh
+        run: |
+          if (Test-Path 'src-tauri/src/agent_state_guard.rs') {
+            rustc --edition=2021 --test src-tauri/src/agent_state_guard.rs -o target/agent-state-guard.exe
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+            & .\target\agent-state-guard.exe --nocapture
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          } else {
+            Write-Output 'SKIP agent_state_guard: owner source absent; no runtime regression executed'
+          }
+      - name: Windows provider OAuth process contract when owner source is present
+        shell: pwsh
+        run: |
+          if (Test-Path 'src-tauri/tests/provider_oauth_cli_process.rs') {
+            cargo test --manifest-path src-tauri/Cargo.toml --locked --features cloud-cli --test provider_oauth_cli_process
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          } else {
+            Write-Output 'SKIP provider_oauth_cli_process: owner source absent; no runtime regression executed'
+          }
 
   llm-engine-build:
     runs-on: ubuntu-latest
@@ -106,12 +158,17 @@ jobs:
           persist-credentials: false
       - name: Install build deps (llama.cpp native + tauri)
         run: |
-          sudo apt-get update
+          for source_file in /etc/apt/sources.list.d/*; do
+            if [[ -f "$source_file" ]] && grep -q 'dl.google.com/linux/chrome' "$source_file"; then
+              sudo rm -f "$source_file"
+            fi
+          done
+          sudo apt-get -o Acquire::Retries=3 update
           sudo apt-get install -y cmake clang libclang-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: src-tauri
           cache-targets: false
       - name: Build with llm-engine (compiles real llama.cpp CPU + engine.rs FFI)
-        run: cargo test --manifest-path src-tauri/Cargo.toml --features llm-engine --lib --no-run
+        run: cargo test --manifest-path src-tauri/Cargo.toml --features llm-engine --lib --no-run

src/lib/testWorkflowExactHeadContract.test.ts

@@ -13,7 +13,7 @@ describe("Test workflow checkout provenance", () => {
       line.includes("- uses: actions/checkout@") ? [index] : [],
     );
 
-    expect(checkoutIndexes).toHaveLength(3);
+    expect(checkoutIndexes.length).toBeGreaterThanOrEqual(4);
     for (const checkoutIndex of checkoutIndexes) {
       const stepIndent = lines[checkoutIndex].match(/^(\s*)/)?.[1] ?? "";
       let endIndex = checkoutIndex + 1;

src/lib/testWorkflowPathFilterContract.test.ts

@@ -0,0 +1,137 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { spawnSync } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+const workflow = readFileSync(resolve(repositoryRoot, ".github/workflows/test.yml"), "utf8");
+
+function scalarValue(raw: string): string {
+  const value = raw.trim();
+  if (value.startsWith('"')) {
+    const end = value.indexOf('"', 1);
+    return end >= 0 ? value.slice(1, end) : value.slice(1);
+  }
+  if (value.startsWith("'")) {
+    const end = value.indexOf("'", 1);
+    return end >= 0 ? value.slice(1, end) : value.slice(1);
+  }
+  return value.split(/\s+#/, 1)[0].trim();
+}
+
+function negativePathsIgnoreEntries(source: string): string[] {
+  const negatives: string[] = [];
+  const lines = source.split(/\r?\n/);
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const key = lines[index].match(/^(\s*)paths-ignore:\s*(.*)$/);
+    if (!key) continue;
+
+    const keyIndent = key[1].length;
+    const inline = key[2].trim();
+    if (inline) {
+      const listBody = inline.startsWith("[") && inline.endsWith("]")
+        ? inline.slice(1, -1)
+        : inline;
+      for (const rawItem of listBody.split(",")) {
+        const value = scalarValue(rawItem);
+        if (value.startsWith("!")) negatives.push(value);
+      }
+      continue;
+    }
+
+    for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
+      const line = lines[cursor];
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+
+      const indent = line.length - line.trimStart().length;
+      if (indent <= keyIndent) break;
+
+      const listItem = trimmed.match(/^-\s*(.+)$/);
+      if (!listItem) continue;
+      const value = scalarValue(listItem[1]);
+      if (value.startsWith("!")) negatives.push(value);
+    }
+  }
+
+  return negatives;
+}
+
+describe("test workflow path-filter contract", () => {
+  it("detects negative paths-ignore entries after comments and in inline lists", () => {
+    const fixtures = [
+      `pull_request:\n  paths-ignore:\n    - "docs/**"\n    # contract exception\n    - "!docs/example.md"\n`,
+      `push:\n  paths-ignore: ["docs/**", "!docs/example.md"]\n`,
+    ];
+
+    for (const fixture of fixtures) {
+      expect(negativePathsIgnoreEntries(fixture)).toContain("!docs/example.md");
+    }
+  });
+
+  it("does not put negative globs under paths-ignore", () => {
+    expect(negativePathsIgnoreEntries(workflow)).toEqual([]);
+  });
+
+  it("runs the Windows agent-state regression when that owner source is present", () => {
+    expect(workflow).toContain("Test-Path 'src-tauri/src/agent_state_guard.rs'");
+    expect(workflow).toContain(
+      "rustc --edition=2021 --test src-tauri/src/agent_state_guard.rs -o target/agent-state-guard.exe",
+    );
+    expect(workflow).toContain("& .\\target\\agent-state-guard.exe --nocapture");
+  });
+
+  it("reports absent Windows agent-state source without claiming runtime evidence", () => {
+    expect(workflow).toContain(
+      "SKIP agent_state_guard: owner source absent; no runtime regression executed",
+    );
+  });
+
+  it("runs the provider OAuth Windows process contract when that owner source is present", () => {
+    expect(workflow).toContain("Test-Path 'src-tauri/tests/provider_oauth_cli_process.rs'");
+    expect(workflow).toContain(
+      "cargo test --manifest-path src-tauri/Cargo.toml --locked --features cloud-cli --test provider_oauth_cli_process",
+    );
+  });
+
+  it("isolates Ubuntu dependency refresh from the hosted runner Chrome repository without weakening apt verification", () => {
+    expect(workflow.match(/grep -q 'dl\.google\.com\/linux\/chrome'/g)).toHaveLength(2);
+    expect(workflow.match(/apt-get -o Acquire::Retries=3 update/g)).toHaveLength(2);
+    expect(workflow).not.toContain("AllowInsecureRepositories");
+    expect(workflow).not.toContain("--allow-unauthenticated");
+  });
+});
+
+// Exercise the canonical shell admission without compiling or faking Rust test results.
+it("macOS cache job executes present owner tests, reports absent source, and propagates failure", () => {
+  const job = workflow.split("  macos-cache-cleanup:\n")[1]?.split("  windows-home-resolution:")[0] ?? "";
+  expect(job).toContain("runs-on: macos-latest");
+  expect(job).toContain("ref: ${{ github.event.pull_request.head.sha || github.sha }}");
+  const script = job.match(/        run: \|\n([\s\S]*)/)?.[1].replace(/^          /gm, "") ?? "";
+  for (const target of ["cache_cleanup_corepack_scope", "cache_cleanup_cli_permanent_gradle", "generated_cache_staged_activity"]) {
+    expect(script).toContain(target);
+  }
+  const fixture = mkdtempSync(resolve(tmpdir(), "disksage-workflow-admission-"));
+  try {
+    const bin = resolve(fixture, "bin");
+    mkdirSync(bin);
+    const log = resolve(fixture, "cargo.log");
+    writeFileSync(resolve(bin, "cargo"), "#!/usr/bin/env bash\nprintf '%s\\n' \"$*\" >> \"$CARGO_LOG\"\nexit \"${CARGO_EXIT:-0}\"\n", { mode: 0o700 });
+    const env = { ...process.env, PATH: `${bin}:${process.env.PATH}`, CARGO_LOG: log };
+    const run = (extra = {}) => spawnSync("bash", ["-e", "-c", script], { cwd: fixture, env: { ...env, ...extra }, encoding: "utf8" });
+    const absent = run();
+    expect(absent.status).toBe(0);
+    expect(absent.stdout.match(/no runtime regression executed/g)).toHaveLength(3);
+    expect(existsSync(log)).toBe(false);
+    mkdirSync(resolve(fixture, "src-tauri/tests"), { recursive: true });
+    writeFileSync(resolve(fixture, "src-tauri/tests/generated_cache_staged_activity.rs"), "");
+    expect(run().status).toBe(0);
+    expect(readFileSync(log, "utf8")).toBe("test --manifest-path src-tauri/Cargo.toml --test generated_cache_staged_activity\n");
+    expect(run({ CARGO_EXIT: "7" }).status).toBe(7);
+  } finally {
+    rmSync(fixture, { recursive: true, force: true });
+  }
+});