Keep managed source paths canonical across outer workbench aliases (#713)

test/managed-source-path.test.ts

@@ -0,0 +1,32 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { managedResourcePath } from "../src/capability-language/managed-source-path.js";
+
+test("source registration permits an outer workbench alias, never nested checkout or resources symlinks", async (t) => {
+  const scratch = await fs.mkdtemp(path.join(os.tmpdir(), "qx-managed-source-path-"));
+  t.after(() => fs.rm(scratch, { recursive: true, force: true }));
+  const root = path.join(scratch, "retained/workbench"),
+    alias = path.join(scratch, "guest"),
+    outside = path.join(scratch, "outside");
+  await fs.mkdir(path.join(root, "resources/Package"), { recursive: true });
+  await fs.mkdir(outside);
+  await fs.symlink(root, alias);
+  for (const registered of [
+    "resources/Package",
+    path.join(alias, "resources/Package"),
+    path.relative(root, path.join(alias, "resources/Package")),
+  ])
+    assert.equal(await managedResourcePath(alias, registered), "resources/Package");
+  await fs.symlink(path.join(root, "resources/Package"), path.join(root, "resources/Alias"));
+  await assert.rejects(managedResourcePath(root, "resources/Alias"), /crosses a symlink/);
+  await fs.symlink(outside, path.join(root, "resources/Escape"));
+  await assert.rejects(managedResourcePath(root, "resources/Escape"), /escapes the workbench/);
+  await fs.mkdir(path.join(outside, "resources/Package"), { recursive: true });
+  await assert.rejects(managedResourcePath(root, path.join(outside, "resources/Package")), /escapes the workbench/);
+  await fs.rename(path.join(root, "resources"), path.join(root, "relocated-resources"));
+  await fs.symlink(path.join(root, "relocated-resources"), path.join(root, "resources"));
+  await assert.rejects(managedResourcePath(root, "resources/Package"), /crosses a symlink/);
+});

test/pin-upgrades.test.ts

@@ -156,6 +156,26 @@ test(
     );
     assert.equal(graph.resources[0].directory, "resources/Named");
     assert.equal(graph.directResources[0].directory, "resources/Named");
+    const alias = `${workbench}-guest-alias`;
+    await fs.symlink(workbench, alias);
+    context.after(() => fs.unlink(alias));
+    const graphFile = path.join(workbench, ".quixos/resource-graph.json");
+    await fs.writeFile(
+      graphFile,
+      JSON.stringify({
+        ...graph,
+        resources: graph.resources.map((entry: { directory: string }) => ({
+          ...entry,
+          directory: path.join(alias, entry.directory),
+        })),
+      }),
+    );
+    assert.equal((await discoverUpgradeSpec(alias)).nodes[1]!.directory, "resources/Named");
+    const aliasPlan = await planPinUpgrades(alias, { ...(await discoverUpgradeSpec(alias)), bootstrap: true });
+    await applyPinUpgrades(aliasPlan);
+    const refreshed = JSON.parse(await fs.readFile(graphFile, "utf8"));
+    assert.equal(refreshed.resources[0].directory, "resources/Named");
+    assert.equal(refreshed.directResources[0].directory, "resources/Named");
     // A retained workbench can move without keeping its original absolute path
     // alive. Recovery journals remain bound to their original writer/root.
     const relocated = `${workbench}-relocated`;