test(desktop): make the unit suite pass on a Windows host

The desktop suite is run by CI on macOS, where it passes; on Windows 19
tests failed for reasons in the host rather than the code under test.

- 15 tests are skipped on win32: eleven build their fixture with
  symlink(), which Windows refuses without Developer Mode or elevation,
  and four assert POSIX mode bits (0o600/0o700) that Windows does not
  have.
- Three path expectations were hard-coded with `/`; they now go through
  path.join or basename, matching the implementation.
- The microphone-settings ipc test expected a settings pane only on
  macOS, but the handler has carried a Windows ms-settings URL since it
  was written.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: Thewookie-Eng

apps/desktop/src/main/browser-agent/file-transfer.test.ts

@@ -1,7 +1,7 @@
 import { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
 import { open, rename, rm, truncate } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { basename, join } from 'node:path'
 import { BROWSER_FILE_TRANSFER_MAX_BYTES } from '@sim/browser-protocol'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -59,7 +59,7 @@ describe('stageUploadFiles', () => {
       body: JSON.stringify({ toolCallId: 'call-1', index: 0 }),
       signal,
     })
-    expect(staged.map((path) => path.split('/').pop())).toEqual(['Q3 plan.pdf', 'granted.txt'])
+    expect(staged.map((path) => basename(path))).toEqual(['Q3 plan.pdf', 'granted.txt'])
     expect(readFileSync(staged[0], 'utf8')).toBe('workspace bytes')
     expect(readFileSync(staged[1], 'utf8')).toBe('local bytes')
     expect(staged.every((path) => path.startsWith(join(temp, 'sim-browser-uploads')))).toBe(true)
@@ -83,7 +83,7 @@ describe('stageUploadFiles', () => {
     })
 
     expect(staged.startsWith(join(temp, 'sim-browser-uploads'))).toBe(true)
-    expect(staged.endsWith('/evil')).toBe(true)
+    expect(basename(staged)).toBe('evil')
   })
 
   it('refuses a workspace file over the transfer ceiling', async () => {

apps/desktop/src/main/browser-credentials/vault.test.ts

@@ -86,7 +86,8 @@ describe('CredentialVault', () => {
     expect(JSON.parse(onDisk)).toMatchObject({ version: 1, ciphertext: expect.any(String) })
   })
 
-  it('writes the vault file owner-only', async () => {
+  // Windows has no POSIX mode bits to assert on.
+  it.skipIf(process.platform === 'win32')('writes the vault file owner-only', async () => {
     const vault = new CredentialVault(vaultPath, encryption())
     await vault.importCredentials(CANDIDATES, 'keep-existing')
 

apps/desktop/src/main/browser-import/chromium-profiles.test.ts

@@ -48,6 +48,10 @@ async function writeLocalState(
   )
 }
 
+// Creating a symlink on Windows needs Developer Mode or elevation, which the
+// test runner cannot assume.
+const NO_SYMLINKS = process.platform === 'win32'
+
 describe('listBrowserProfiles', () => {
   it('returns display names, default profile first, with namespaced ids', async () => {
     await addProfile(CHROME, 'Profile 2')
@@ -81,7 +85,7 @@ describe('listBrowserProfiles', () => {
     expect(profiles.map(({ id }) => id)).toEqual(['chrome:Default'])
   })
 
-  it('refuses a profile directory redirected through a symlink', async () => {
+  it.skipIf(NO_SYMLINKS)('refuses a profile directory redirected through a symlink', async () => {
     const outsideProfile = join(home, 'outside-profile')
     await mkdir(outsideProfile, { recursive: true })
     await writeFile(join(outsideProfile, 'Login Data'), '')
@@ -93,20 +97,23 @@ describe('listBrowserProfiles', () => {
     await expect(listBrowserProfiles(CHROME, home)).resolves.toEqual([])
   })
 
-  it('refuses symlinked, hard-linked, and non-file password databases', async () => {
-    const outsideDatabase = join(home, 'outside-login-data')
-    await writeFile(outsideDatabase, '')
-
-    const userDataDir = userDataDirFor(CHROME, home)
-    for (const directory of ['Default', 'Profile 2', 'Profile 3']) {
-      await mkdir(join(userDataDir, directory), { recursive: true })
+  it.skipIf(NO_SYMLINKS)(
+    'refuses symlinked, hard-linked, and non-file password databases',
+    async () => {
+      const outsideDatabase = join(home, 'outside-login-data')
+      await writeFile(outsideDatabase, '')
+
+      const userDataDir = userDataDirFor(CHROME, home)
+      for (const directory of ['Default', 'Profile 2', 'Profile 3']) {
+        await mkdir(join(userDataDir, directory), { recursive: true })
+      }
+      await symlink(outsideDatabase, join(userDataDir, 'Default', 'Login Data For Account'))
+      await link(outsideDatabase, join(userDataDir, 'Profile 2', 'Login Data For Account'))
+      await mkdir(join(userDataDir, 'Profile 3', 'Login Data For Account'))
+
+      await expect(listBrowserProfiles(CHROME, home)).resolves.toEqual([])
     }
-    await symlink(outsideDatabase, join(userDataDir, 'Default', 'Login Data For Account'))
-    await link(outsideDatabase, join(userDataDir, 'Profile 2', 'Login Data For Account'))
-    await mkdir(join(userDataDir, 'Profile 3', 'Login Data For Account'))
-
-    await expect(listBrowserProfiles(CHROME, home)).resolves.toEqual([])
-  })
+  )
 })
 
 describe('listAllBrowserProfiles', () => {

apps/desktop/src/main/desktop-chat-session-store.test.ts

@@ -100,23 +100,27 @@ describe('DesktopChatSessionStore', () => {
     expect(restarted.getTerminal(ORIGIN, 'chat-a')).toEqual(TERMINAL)
   })
 
-  it('encrypts the complete descriptor payload and writes it owner-only', () => {
-    const provider = encryption()
-    const store = open(provider)
-    store.setBrowser(ORIGIN, 'chat-secret', BROWSER)
-    store.setTerminal(ORIGIN, 'chat-secret', TERMINAL)
-
-    expect(store.flush()).toBe(true)
-
-    const onDisk = readFileSync(filePath, 'utf8')
-    expect(onDisk).not.toContain('chat-secret')
-    expect(onDisk).not.toContain('example.com')
-    expect(onDisk).not.toContain('/Users/ada/code')
-    expect(onDisk).not.toContain('report.csv')
-    expect(JSON.parse(onDisk)).toEqual({ v: 1, ciphertext: expect.any(String) })
-    expect(provider.encryptString).toHaveBeenCalledOnce()
-    expect(statSync(filePath).mode & 0o077).toBe(0)
-  })
+  // Windows has no POSIX mode bits to assert on.
+  it.skipIf(process.platform === 'win32')(
+    'encrypts the complete descriptor payload and writes it owner-only',
+    () => {
+      const provider = encryption()
+      const store = open(provider)
+      store.setBrowser(ORIGIN, 'chat-secret', BROWSER)
+      store.setTerminal(ORIGIN, 'chat-secret', TERMINAL)
+
+      expect(store.flush()).toBe(true)
+
+      const onDisk = readFileSync(filePath, 'utf8')
+      expect(onDisk).not.toContain('chat-secret')
+      expect(onDisk).not.toContain('example.com')
+      expect(onDisk).not.toContain('/Users/ada/code')
+      expect(onDisk).not.toContain('report.csv')
+      expect(JSON.parse(onDisk)).toEqual({ v: 1, ciphertext: expect.any(String) })
+      expect(provider.encryptString).toHaveBeenCalledOnce()
+      expect(statSync(filePath).mode & 0o077).toBe(0)
+    }
+  )
 
   it('does not replace the durable store with an oversized encrypted envelope', () => {
     const provider = encryption()

apps/desktop/src/main/downloads.test.ts

@@ -16,7 +16,8 @@ describe('sanitizeFilename', () => {
 })
 
 describe('uniqueDownloadPath', () => {
-  it('treats a dangling symlink as occupied', async () => {
+  // Creating a symlink on Windows needs Developer Mode or elevation.
+  it.skipIf(process.platform === 'win32')('treats a dangling symlink as occupied', async () => {
     const directory = mkdtempSync(join(tmpdir(), 'sim-download-path-'))
     symlinkSync(join(directory, 'missing-target'), join(directory, 'report.csv'))
 
@@ -45,7 +46,7 @@ describe('uniqueDownloadPath', () => {
     ])
 
     expect(new Set([first, second])).toEqual(
-      new Set(['/Downloads/report.csv', '/Downloads/report (copy-1).csv'])
+      new Set([join('/Downloads', 'report.csv'), join('/Downloads', 'report (copy-1).csv')])
     )
   })
 })

apps/desktop/src/main/ipc.test.ts

@@ -371,8 +371,10 @@ describe('registerIpcHandlers', () => {
 
     expect(await handler?.(evilEvent)).toBe(false)
     expect(await handler?.(appEvent)).toBe(false)
-    expect(await handler?.(activeAppEvent)).toBe(process.platform === 'darwin')
-    expect(shell.openExternal).toHaveBeenCalledTimes(process.platform === 'darwin' ? 1 : 0)
+    // Only macOS and Windows have a settings URL to open.
+    const hasSettingsPane = process.platform === 'darwin' || process.platform === 'win32'
+    expect(await handler?.(activeAppEvent)).toBe(hasSettingsPane)
+    expect(shell.openExternal).toHaveBeenCalledTimes(hasSettingsPane ? 1 : 0)
   })
 
   it('restricts the OAuth connect handoff to an activated app origin', async () => {

apps/desktop/src/main/local-files.test.ts

@@ -12,21 +12,28 @@ afterEach(async () => {
   await rm(root, { recursive: true, force: true })
 })
 
-it('rejects missing paths and directory cycles with explicit errors before uploading', async () => {
-  expect(
-    await executeLocalFileRequest(
-      { operation: 'read' },
-      { toolName: 'read_local_file', args: { path: join(root, 'missing') } }
-    )
-  ).toMatchObject({ ok: false })
-  await symlink(root, join(root, 'cycle'))
-  expect(
-    await executeLocalFileRequest(
-      { operation: 'manifest' },
-      { toolName: 'import_local_files', args: { path: root, targetWorkspaceId: 'target' } }
-    )
-  ).toMatchObject({ ok: false, error: expect.stringContaining('cycle') })
-})
+// Creating a symlink on Windows needs Developer Mode or elevation, which the
+// test runner cannot assume.
+const NO_SYMLINKS = process.platform === 'win32'
+
+it.skipIf(NO_SYMLINKS)(
+  'rejects missing paths and directory cycles with explicit errors before uploading',
+  async () => {
+    expect(
+      await executeLocalFileRequest(
+        { operation: 'read' },
+        { toolName: 'read_local_file', args: { path: join(root, 'missing') } }
+      )
+    ).toMatchObject({ ok: false })
+    await symlink(root, join(root, 'cycle'))
+    expect(
+      await executeLocalFileRequest(
+        { operation: 'manifest' },
+        { toolName: 'import_local_files', args: { path: root, targetWorkspaceId: 'target' } }
+      )
+    ).toMatchObject({ ok: false, error: expect.stringContaining('cycle') })
+  }
+)
 
 it('refuses oversized import files before any workspace mutation or bulk allocation', async () => {
   const path = join(root, 'large.bin')
@@ -40,7 +47,7 @@ it('refuses oversized import files before any workspace mutation or bulk allocat
   ).toMatchObject({ ok: false, error: expect.stringContaining('64 MB') })
 })
 
-it.each(['file', 'directory'] as const)(
+it.skipIf(NO_SYMLINKS).each(['file', 'directory'] as const)(
   'rejects %s symlinks outside the import source during manifest and chunk reads',
   async (kind) => {
     const source = join(root, 'selected')
@@ -79,38 +86,41 @@ it.each(['file', 'directory'] as const)(
   }
 )
 
-it('supports internal symlinks and an explicitly selected symlink root, but rejects a retargeted child', async () => {
-  const source = join(root, 'selected')
-  await mkdir(source)
-  await writeFile(join(source, 'notes.txt'), 'inside')
-  await symlink(join(source, 'notes.txt'), join(source, 'alias.txt'))
-  const selectedAlias = join(root, 'selected-alias')
-  await symlink(source, selectedAlias)
-  const authorization = {
-    toolName: 'import_local_files',
-    args: { path: selectedAlias, targetWorkspaceId: 'target' },
-  }
-  const manifest = await executeLocalFileRequest({ operation: 'manifest' }, authorization)
-  if (!manifest.ok || manifest.data.kind !== 'manifest') throw new Error('Expected manifest')
-  const entry = manifest.data.entries.find((item) => item.relativePath === 'alias.txt')!
-  const request = {
-    operation: 'chunk',
-    relativePath: 'alias.txt',
-    revision: entry.revision,
-    offset: 0,
+it.skipIf(NO_SYMLINKS)(
+  'supports internal symlinks and an explicitly selected symlink root, but rejects a retargeted child',
+  async () => {
+    const source = join(root, 'selected')
+    await mkdir(source)
+    await writeFile(join(source, 'notes.txt'), 'inside')
+    await symlink(join(source, 'notes.txt'), join(source, 'alias.txt'))
+    const selectedAlias = join(root, 'selected-alias')
+    await symlink(source, selectedAlias)
+    const authorization = {
+      toolName: 'import_local_files',
+      args: { path: selectedAlias, targetWorkspaceId: 'target' },
+    }
+    const manifest = await executeLocalFileRequest({ operation: 'manifest' }, authorization)
+    if (!manifest.ok || manifest.data.kind !== 'manifest') throw new Error('Expected manifest')
+    const entry = manifest.data.entries.find((item) => item.relativePath === 'alias.txt')!
+    const request = {
+      operation: 'chunk',
+      relativePath: 'alias.txt',
+      revision: entry.revision,
+      offset: 0,
+    }
+    expect(await executeLocalFileRequest(request, authorization)).toEqual({
+      ok: true,
+      data: { kind: 'chunk', bytes: new Uint8Array(Buffer.from('inside')), eof: true },
+    })
+    await writeFile(join(root, 'outside.txt'), 'outside')
+    await rm(join(source, 'alias.txt'))
+    await symlink(join(root, 'outside.txt'), join(source, 'alias.txt'))
+    expect(await executeLocalFileRequest(request, authorization)).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('outside this import source'),
+    })
   }
-  expect(await executeLocalFileRequest(request, authorization)).toEqual({
-    ok: true,
-    data: { kind: 'chunk', bytes: new Uint8Array(Buffer.from('inside')), eof: true },
-  })
-  await writeFile(join(root, 'outside.txt'), 'outside')
-  await rm(join(source, 'alias.txt'))
-  await symlink(join(root, 'outside.txt'), join(source, 'alias.txt'))
-  expect(await executeLocalFileRequest(request, authorization)).toMatchObject({
-    ok: false,
-    error: expect.stringContaining('outside this import source'),
-  })
-})
+)
 
 it('preserves a UTF-8 BOM and rejects split offsets and limits that cannot fit a character', async () => {
   const path = join(root, 'unicode.txt')