CI only: Windows module, test kit and rig

.github/workflows/ci.yml

@@ -446,6 +446,16 @@ jobs:
         continue-on-error: true
         timeout-minutes: 20
         run: cargo test -p basal-host --lib --locked -- spawn_lock_tests --show-output 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-spawn-lock.log"
+      - name: Test the shared test kit on its own
+        id: test-testkit
+        continue-on-error: true
+        timeout-minutes: 30
+        run: cargo test -p basal-testkit --locked --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-testkit.log"
+      - name: Test the integration rig on its own
+        id: test-rig
+        continue-on-error: true
+        timeout-minutes: 30
+        run: cargo test -p basal-rig --locked --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-rig.log"
       - name: Check every workspace target
         id: check
         continue-on-error: true
@@ -473,6 +483,11 @@ jobs:
         continue-on-error: true
         timeout-minutes: 30
         run: cargo test -p basal-host --lib --locked --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-host.log"
+      - name: Test the host integration regressions on their own
+        id: test-host-regressions
+        continue-on-error: true
+        timeout-minutes: 20
+        run: cargo test -p basal-host --test builtin_host_regressions --locked --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/windows-baseline/test-basal-host-regressions.log"
       - name: Summarize the baseline
         if: always()
         run: |
@@ -484,6 +499,8 @@ jobs:
             echo "- cargo test -p basal-launch --features deviations --locked: ${{ steps.test-launch.outcome }}"
             echo "- cargo test -p basal-module -p basal-core --locked --no-fail-fast: ${{ steps.test-module.outcome }}"
             echo "- cargo test -p basal-host --lib --locked -- spawn_lock_tests: ${{ steps.test-spawn-lock.outcome }}"
+            echo "- cargo test -p basal-testkit --locked --no-fail-fast: ${{ steps.test-testkit.outcome }}"
+            echo "- cargo test -p basal-rig --locked --no-fail-fast: ${{ steps.test-rig.outcome }}"
           } >> "$GITHUB_STEP_SUMMARY"
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()

crates/basal-host/tests/builtin_host_regressions.rs

@@ -2,6 +2,7 @@ use basal_host::builtins::{BuiltinHost, Grant, codes, envelope, fs, git, net};
 use basal_host::{CallClass, CallRequest, Dispatched, Host};
 use basal_proto::{CallKind, JsonText, Primitive, Settlement};
 use serde_json::json;
+#[cfg(unix)]
 use std::os::unix::fs::{PermissionsExt, symlink};
 use std::path::PathBuf;
 use std::sync::atomic::{AtomicU64, Ordering};
@@ -31,7 +32,7 @@ impl Drop for Tree {
 #[test]
 fn escaped_800kb_file_is_a_typed_refusal_not_successful_null() {
     let tree = Tree::new();
-    let path = tree.0.join("root/escaped");
+    let path = tree.0.join("root").join("escaped");
     std::fs::write(&path, vec![0; 800 * 1024]).unwrap();
     let request = CallRequest {
         flow_id: "f".into(),
@@ -63,6 +64,7 @@ fn escaped_800kb_file_is_a_typed_refusal_not_successful_null() {
 }
 
 #[test]
+#[cfg(unix)]
 fn escaped_listing_exceeds_encoded_cap_as_a_typed_refusal() {
     let tree = Tree::new();
     let dir = tree.0.join("root");
@@ -106,13 +108,16 @@ fn outside_missing_and_symlink_targets_have_identical_refusals() {
     let tree = Tree::new();
     let existing = tree.0.join("secret");
     std::fs::write(&existing, "secret").unwrap();
+    #[cfg(unix)]
     let link = tree.0.join("root/link");
+    #[cfg(unix)]
     symlink(&existing, &link).unwrap();
-    let missing = tree.0.join("absent/child");
+    let missing = tree.0.join("absent").join("child");
     for purpose in [fs::Purpose::Read, fs::Purpose::Write] {
         let a = fs::resolve(existing.to_str().unwrap(), &tree.roots(), purpose).unwrap_err();
         let b = fs::resolve(missing.to_str().unwrap(), &tree.roots(), purpose).unwrap_err();
         assert_eq!(a, b);
+        #[cfg(unix)]
         if purpose == fs::Purpose::Read {
             assert_eq!(
                 a,
@@ -122,16 +127,20 @@ fn outside_missing_and_symlink_targets_have_identical_refusals() {
         assert_eq!(a.code, codes::DENIED);
         assert!(!a.message.contains(tree.0.to_str().unwrap()));
     }
+    let op = git::Op::RevParse {
+        reference: "HEAD".into(),
+    };
     assert_eq!(
-        git::repo(existing.to_str().unwrap(), &tree.roots()).unwrap_err(),
-        git::repo(missing.to_str().unwrap(), &tree.roots()).unwrap_err()
+        git::run(existing.to_str().unwrap(), &tree.roots(), &op).unwrap_err(),
+        git::run(missing.to_str().unwrap(), &tree.roots(), &op).unwrap_err()
     );
 }
 
 #[test]
+#[cfg(unix)]
 fn atomic_write_drops_special_permission_bits() {
     let tree = Tree::new();
-    let path = tree.0.join("root/file");
+    let path = tree.0.join("root").join("file");
     std::fs::write(&path, "old").unwrap();
     std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o6755)).unwrap();
     fs::write(path.to_str().unwrap(), &tree.roots(), "").unwrap();
@@ -179,6 +188,7 @@ fn method_override_and_compression_headers_are_denied() {
 }
 
 #[test]
+#[cfg(unix)]
 fn git_reaps_descendants_that_keep_its_output_pipe_open() {
     use std::process::{Command, Stdio};
     use std::time::Duration;
@@ -219,13 +229,21 @@ fn git_reaps_descendants_that_keep_its_output_pipe_open() {
 fn tag_patterns_use_git_globs_including_hierarchical_names() {
     let tree = Tree::new();
     let repo = tree.0.join("root");
+    let global_config = tree.0.join("empty.gitconfig");
+    std::fs::write(&global_config, []).unwrap();
     let git_command = |args: &[&str]| {
         let result = std::process::Command::new("git")
+            .env_clear()
+            .envs(std::env::vars_os().filter(|(key, _)| {
+                ["PATH", "HOME", "SystemRoot", "USERPROFILE"]
+                    .iter()
+                    .any(|kept| key.to_string_lossy().eq_ignore_ascii_case(kept))
+            }))
             .arg("-C")
             .arg(&repo)
             .args(args)
             .env("GIT_CONFIG_NOSYSTEM", "1")
-            .env("GIT_CONFIG_GLOBAL", "/dev/null")
+            .env("GIT_CONFIG_GLOBAL", &global_config)
             .env("GIT_AUTHOR_NAME", "Fixture")
             .env("GIT_AUTHOR_EMAIL", "fixture@example.invalid")
             .env("GIT_COMMITTER_NAME", "Fixture")

crates/basal-rig/Cargo.toml

@@ -31,6 +31,15 @@ subc-client-rs.workspace = true
 subc-protocol.workspace = true
 tokio = { workspace = true, features = ["sync", "time"] }
 
+[target.'cfg(windows)'.dependencies]
+basal-launch.workspace = true
+rusqlite = { workspace = true, features = ["bundled"] }
+windows-sys = { version = "0.61", features = [
+    "Win32_Foundation",
+    "Win32_System_Diagnostics_ToolHelp",
+    "Win32_System_Threading",
+] }
+
 [dev-dependencies]
 basal-host.workspace = true
 basal-proto.workspace = true

crates/basal-rig/src/bin/basal-rig-contract.rs

@@ -50,6 +50,9 @@ mod ownership;
 mod package_cases;
 #[path = "basal-rig-contract/seeded.rs"]
 mod seeded;
+#[cfg(windows)]
+#[path = "basal-rig-contract/windows.rs"]
+mod windows;
 
 const CORE: &str = "prefrontal-core";
 const BASAL: &str = "basal";
@@ -1394,6 +1397,7 @@ async fn relay_refusals(rig: &Rig, flow: &Flow, agent: &Agent) -> Case {
     case
 }
 
+#[cfg(unix)]
 fn basal_pid() -> Option<String> {
     let out = std::process::Command::new("ps")
         .args(["-axo", "pid=,command="])
@@ -1411,6 +1415,11 @@ fn basal_pid() -> Option<String> {
         })
 }
 
+#[cfg(windows)]
+fn basal_pid() -> Option<String> {
+    windows::basal_pid()
+}
+
 async fn crash(rig: &Rig, flow: &Flow, agent: &Agent, since: i64) -> Case {
     let mut case = Case::new(CRASH_CASE);
     // Arm the kill switch before approving, so the flow's first run cannot

crates/basal-rig/src/bin/basal-rig-contract/seeded.rs

@@ -9,20 +9,30 @@ pub(super) fn module_cli_path(home: &std::path::Path) -> Result<PathBuf, String>
     {
         return Err("module control requires the isolated ckdev-flows home".into());
     }
-    Ok(root.join("bin/ckdev-ck"))
+    #[cfg(unix)]
+    {
+        Ok(root.join("bin/ckdev-ck"))
+    }
+    #[cfg(windows)]
+    {
+        Ok(root.join("bin").join("ckdev-ck.exe"))
+    }
 }
 
 pub(super) fn ck(args: &[&str]) -> Result<Value, String> {
     let connection =
         std::env::var_os("SUBC_CONNECTION_FILE").ok_or("no isolated connection file")?;
     let home = PathBuf::from(std::env::var_os("HOME").ok_or("missing isolated HOME")?);
+    #[cfg(unix)]
     let output = std::process::Command::new(module_cli_path(&home)?)
         .arg("--subc")
         .arg(connection)
         .arg("--json")
         .args(args)
         .output()
         .map_err(|e| e.to_string())?;
+    #[cfg(windows)]
+    let output = super::windows::ck_output(module_cli_path(&home)?, connection, args)?;
     if !output.status.success() {
         return Err(format!(
             "ckdev-ck {args:?}: {} {}",
@@ -195,6 +205,7 @@ pub(super) async fn stale(
     case
 }
 
+#[cfg(unix)]
 pub(super) fn no_store_handles(path: &std::path::Path) -> Result<(), String> {
     let mut command = std::process::Command::new("lsof");
     command.arg("-F").arg("p").arg(path);
@@ -212,3 +223,33 @@ pub(super) fn no_store_handles(path: &std::path::Path) -> Result<(), String> {
     }
     Ok(())
 }
+
+#[cfg(windows)]
+pub(super) fn no_store_handles(path: &std::path::Path) -> Result<(), String> {
+    use std::os::windows::fs::OpenOptionsExt;
+    let mut files = vec![path.to_path_buf()];
+    for suffix in ["-wal", "-shm"] {
+        let sidecar = PathBuf::from(format!("{}{suffix}", path.display()));
+        if sidecar.exists() {
+            files.push(sidecar);
+        }
+    }
+    // No-sharing opens refuse while any other reader or writer owns the file.
+    // Hold all three together so the observation covers the store and sidecars.
+    let _handles = files
+        .iter()
+        .map(|file| {
+            std::fs::OpenOptions::new()
+                .read(true)
+                .share_mode(0)
+                .open(file)
+                .map_err(|e| {
+                    format!(
+                        "cannot prove {} has no open store handles: {e}",
+                        file.display()
+                    )
+                })
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(())
+}

crates/basal-rig/src/bin/basal-rig-contract/tests.rs

@@ -129,15 +129,19 @@ fn seeded_fixture_requires_a_terminal_disabled_module_and_no_pid() {
 
 #[test]
 fn seeded_fixture_rejects_foreign_paths_and_symlinked_stores() {
-    let output = std::process::Command::new("mktemp")
-        .arg("-d")
-        .arg(std::env::temp_dir().join("basal-rig-fixture.XXXXXXXX"))
-        .output()
-        .unwrap();
-    assert!(output.status.success());
-    let root = PathBuf::from(String::from_utf8(output.stdout).unwrap().trim())
-        .canonicalize()
-        .unwrap();
+    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+    let root = loop {
+        let root = std::env::temp_dir().join(format!(
+            "basal-rig-fixture-{}-{}",
+            std::process::id(),
+            NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
+        ));
+        match std::fs::create_dir(&root) {
+            Ok(()) => break root.canonicalize().unwrap(),
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+            Err(error) => panic!("create isolated fixture: {error}"),
+        }
+    };
     let rig = root.join("ckdev-flows");
     let home = rig.join("home");
     let store = rig.join("data/cortexkit/basal/store.db");
@@ -151,9 +155,12 @@ fn seeded_fixture_rejects_foreign_paths_and_symlinked_stores() {
     let foreign = root.join("production.db");
     std::fs::write(&foreign, []).unwrap();
     assert!(seeded::fixture_path_for(&home, &foreign, "basal").is_err());
-    std::fs::remove_file(&store).unwrap();
-    std::os::unix::fs::symlink(&foreign, &store).unwrap();
-    assert!(seeded::fixture_path_for(&home, &store, "basal").is_err());
+    #[cfg(unix)]
+    {
+        std::fs::remove_file(&store).unwrap();
+        std::os::unix::fs::symlink(&foreign, &store).unwrap();
+        assert!(seeded::fixture_path_for(&home, &store, "basal").is_err());
+    }
     assert!(seeded::fixture_path_for(&home, &store, "other").is_err());
     std::fs::remove_dir_all(&root).unwrap();
 }
@@ -191,10 +198,38 @@ fn authorship_fingerprint_allows_only_the_one_author_cell() {
 
 #[test]
 fn fixture_module_control_uses_only_the_absolute_isolated_cli() {
+    let root = std::env::temp_dir().join("rig").join("ckdev-flows");
+    let home = root.join("home");
     assert_eq!(
-        seeded::module_cli_path(std::path::Path::new("/rig/ckdev-flows/home")).unwrap(),
-        PathBuf::from("/rig/ckdev-flows/bin/ckdev-ck")
+        seeded::module_cli_path(&home).unwrap(),
+        root.join("bin").join(if cfg!(windows) {
+            "ckdev-ck.exe"
+        } else {
+            "ckdev-ck"
+        })
     );
-    assert!(seeded::module_cli_path(std::path::Path::new("/rig/home")).is_err());
+    assert!(seeded::module_cli_path(&std::env::temp_dir().join("rig").join("home")).is_err());
     assert!(seeded::module_cli_path(std::path::Path::new("ckdev-flows/home")).is_err());
 }
+
+#[cfg(windows)]
+#[test]
+fn store_handle_probe_refuses_an_open_database_or_sidecar() {
+    let directory =
+        std::env::temp_dir().join(format!("basal-rig-handle-probe-{}", std::process::id()));
+    std::fs::create_dir(&directory).unwrap();
+    let store = directory.join("store.db");
+    std::fs::write(&store, []).unwrap();
+    for suffix in ["", "-wal", "-shm"] {
+        let path = PathBuf::from(format!("{}{suffix}", store.display()));
+        std::fs::write(&path, []).unwrap();
+        let held = std::fs::File::open(&path).unwrap();
+        assert!(
+            seeded::no_store_handles(&store).is_err(),
+            "open {suffix:?} was not refused"
+        );
+        drop(held);
+        assert!(seeded::no_store_handles(&store).is_ok());
+    }
+    std::fs::remove_dir_all(directory).unwrap();
+}