codewhale-hq/Codewhale
1
0 Fork 0
mirror of https://github.com/codewhale-hq/Codewhale.git synced 2026-11-11 10:01:30 -10:00
Code Issues Packages Projects Releases 1 Wiki Activity

fix(tui): canonicalize agy_credentials fixtures for macOS (#5392) (#5396)

Browse Source 
* WIP: allow intermediate dir symlinks in secure credential open

open_secure_regular_file applied O_NOFOLLOW to every path component, so
macOS TempDir paths under /var (symlink to private/var) failed with
ENOTDIR. Match the documented leaf-only boundary: follow ordinary
intermediate directory symlinks, refuse a symlink/reparse leaf.

Co-authored-by: Lstarsky0 <[email protected]>

Agent-assisted fix for #5392.

* fix(tui): canonicalize agy_credentials TempDir fixtures for macOS

macOS TempDir paths live under /var/folders, and /var is a symlink to
private/var. Production open_secure_regular_file applies O_NOFOLLOW to
every path component, so the four agy_credentials tests failed for an
unrelated path-shape reason. Canonicalize the fixture root only; leave
the production no-follow walk unchanged.

Closes #5392.

Co-authored-by: Lstarsky0 <[email protected]>

Agent-assisted fix for #5392 (fixture-only; reverts prior production walk relaxation).

---------

Co-authored-by: Cursor Agent <[email protected]>
This commit is contained in:
Hunter BownLstarsky0Cursor Agent
 authored and GitHub committed 2026-08-14 22:53:47 -07:00
1 parent dd0fbed81c
commit ad102ec444
1 file changed
+7 -1
Download Patch File Download Diff File Expand all files Collapse all files
crates/tui/src/agy_credentials.rs
+7 -1
View File
@@ -248,7 +248,13 @@ mod tests {
fn fixture_db(token_value: Option<&str>) -> (tempfile::TempDir, std::path::PathBuf) {
let dir = tempfile::tempdir().expect("tempdir");
let path = dir.path().join("state.vscdb");
// Canonicalize: production open_secure_regular_file uses O_NOFOLLOW on
// every path component, so macOS TempDir paths under `/var` (symlink
// to `private/var`) would fail the secure open for an unrelated reason.
// Resolving the fixture root keeps the suite focused on credential
// parsing while preserving the production no-follow boundary.
let root = dir.path().canonicalize().expect("canonical temp root");
let path = root.join("state.vscdb");
let connection = rusqlite::Connection::open(&path).expect("create fixture database");
connection
.execute_batch(