test(workflow): cover path and profile identity guards

Author: Waishnav

src/workflow-files.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -71,6 +71,31 @@ import { hashSource } from "./workflow-script.js";
     /must be inside/,
   );
 
+  if (process.platform !== "win32") {
+    const outside = await mkdtemp(join(tmpdir(), "wf-files-outside-"));
+    try {
+      const outsideScript = join(outside, "escape.js");
+      await writeFile(
+        outsideScript,
+        "export const meta = { name: 'escape', description: 'd' }\nreturn 4\n",
+      );
+      await symlink(
+        outsideScript,
+        join(dir, ".devspace", "workflows", "escape.js"),
+      );
+      await assert.rejects(
+        () =>
+          readProjectWorkflowScriptFile({
+            scriptPath: "escape.js",
+            workspaceRoot: dir,
+          }),
+        /resolves outside/,
+      );
+    } finally {
+      await rm(outside, { recursive: true, force: true });
+    }
+  }
+
   await mkdir(join(dir, "workflows"), { recursive: true });
   await writeFile(
     join(dir, "workflows", "legacy.js"),

src/workflow-replay.test.ts

@@ -20,11 +20,17 @@ function call(
   };
 }
 
-function identity(prompt = "prompt") {
+function identity(
+  prompt = "prompt",
+  profile: { name: string | null; fingerprint: string | null } = {
+    name: null,
+    fingerprint: null,
+  },
+) {
   return {
     prompt,
-    profileName: null,
-    profileFingerprint: null,
+    profileName: profile.name,
+    profileFingerprint: profile.fingerprint,
     provider: "codex" as const,
     model: null,
     effort: null,
@@ -33,6 +39,42 @@ function identity(prompt = "prompt") {
   };
 }
 
+{
+  const replay = createWorkflowReplay([
+    call({
+      callIndex: 0,
+      cacheKey: "profile",
+      profileName: "reviewer",
+      profileFingerprint: "fp-1",
+    }),
+  ]);
+  const miss = replay.decide(
+    0,
+    "profile-name-changed",
+    identity("prompt", { name: "implementer", fingerprint: "fp-1" }),
+  ).miss;
+  assert.equal(miss?.reason, "identity_changed");
+  assert.deepEqual(miss?.changedFields, ["profileName"]);
+}
+
+{
+  const replay = createWorkflowReplay([
+    call({
+      callIndex: 0,
+      cacheKey: "profile",
+      profileName: "reviewer",
+      profileFingerprint: "fp-1",
+    }),
+  ]);
+  const miss = replay.decide(
+    0,
+    "profile-fingerprint-changed",
+    identity("prompt", { name: "reviewer", fingerprint: "fp-2" }),
+  ).miss;
+  assert.equal(miss?.reason, "identity_changed");
+  assert.deepEqual(miss?.changedFields, ["profileFingerprint"]);
+}
+
 {
   const replay = createWorkflowReplay([
     call({ callIndex: 0, cacheKey: "k0", returnValueJson: JSON.stringify("a") }),