fix(fspy): intercept close$NOCANCEL on macOS so libuv (Node) closes fire

On macOS, libuv (and thus Node) closes descriptors via `close$NOCANCEL`,
a distinct libc symbol from `close`. The preload only interposed `close`,
so a write-close from Node was never observed: its `Closing` callback never
fired. For worldline this meant `fs.writeFileSync` wrote the file but the
run captured zero writes ("No file writes were captured"); Rust's std uses
plain `close`, which is why it worked and hid the gap.

Interpose `close$NOCANCEL` onto the same hook (forwarding through the regular
`close`, which closes the descriptor identically). Add two `#[ignore]` Node
regression tests, run in CI's `--ignored` step on every platform: one at the
fspy callback layer asserting Opened+Closing both fire for `fs.writeFileSync`,
and one at the worldline layer mirroring the `worldline node` scenario and
asserting the captured write's before/after content.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: wan9chi

crates/fspy/tests/file_callback.rs

@@ -245,6 +245,53 @@ async fn close_callback_fires_before_close() -> anyhow::Result<()> {
     Ok(())
 }
 
+/// Regression: Node's libuv closes descriptors via `close$NOCANCEL` on macOS, a
+/// distinct libc symbol from `close`. The preload must interpose it too, or the
+/// write-close is never observed. Asserts both `Opened` and `Closing` fire for a
+/// real `fs.writeFileSync`. (On Linux/Windows Node closes via plain `close`, so
+/// the test still validates the open/close pair there.)
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires node"]
+async fn close_callback_fires_for_node_write() -> anyhow::Result<()> {
+    use std::env::vars_os;
+
+    let dir = tempfile::tempdir()?;
+    let dir_path = std::fs::canonicalize(dir.path())?;
+    let out = dir_path.join("node-out.txt");
+
+    let kinds: Arc<Mutex<Vec<FileEventKind>>> = Arc::new(Mutex::new(Vec::new()));
+    let callback = {
+        let (dir_path, kinds) = (dir_path.clone(), Arc::clone(&kinds));
+        move |event: FileEvent<'_>| {
+            let Some(path) = event.path.get() else {
+                return;
+            };
+            if path.starts_with(&dir_path) {
+                kinds.lock().unwrap().push(event.kind);
+            }
+        }
+    };
+
+    let mut command = fspy::Command::new("node");
+    command
+        .arg("-e")
+        .arg("require('fs').writeFileSync(process.argv[1], 'x')")
+        .arg(out.as_os_str())
+        .envs(vars_os()); // https://github.com/jdx/mise/discussions/5968
+    command.on_file_event(AccessMode::WRITE, callback);
+    let child = command.spawn(CancellationToken::new()).await?;
+    let termination = child.wait_handle.await?;
+    assert!(termination.status.success());
+
+    let kinds = kinds.lock().unwrap().clone();
+    assert!(kinds.contains(&FileEventKind::Opened), "expected an Opened event, got {kinds:?}");
+    assert!(
+        kinds.contains(&FileEventKind::Closing),
+        "expected a Closing event for node's write (close$NOCANCEL must be intercepted), got {kinds:?}"
+    );
+    Ok(())
+}
+
 /// The access-mode mask filters which events reach the callback.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn mask_filters_events() -> anyhow::Result<()> {

crates/fspy_preload_unix/src/interceptions/close.rs

@@ -10,6 +10,22 @@ unsafe extern "C" fn close(fd: c_int) -> c_int {
     unsafe { close::original()(fd) }
 }
 
+// On macOS, libuv (Node) closes descriptors via the cancellation-point-free
+// `close$NOCANCEL`, a distinct symbol from `close`. Interpose it onto the same
+// hook so those closes are observed too; forwarding goes through the regular
+// `close` (which closes the descriptor identically).
+#[cfg(target_os = "macos")]
+const _: () = {
+    unsafe extern "C" {
+        #[link_name = "close$NOCANCEL"]
+        fn close_nocancel(fd: c_int) -> c_int;
+    }
+    #[used]
+    #[unsafe(link_section = "__DATA,__interpose")]
+    static mut _INTERPOSE_CLOSE_NOCANCEL: crate::macros::InterposeEntry =
+        crate::macros::InterposeEntry { _new: close as *const _, _old: close_nocancel as *const _ };
+};
+
 intercept!(fclose(64): unsafe extern "C" fn(stream: *mut FILE) -> c_int);
 unsafe extern "C" fn fclose(stream: *mut FILE) -> c_int {
     if !stream.is_null() {

crates/worldline/tests/capture.rs

@@ -91,3 +91,41 @@ async fn captures_writes_with_before_and_after() {
         "non-UTF-8 img.bin should be served as a base64 blob"
     );
 }
+
+/// Regression for the user-facing `worldline node` scenario: Node's libuv closes
+/// descriptors via `close$NOCANCEL` on macOS — a distinct libc symbol from
+/// `close`. If fspy doesn't interpose it, the write-close is never observed, so
+/// `fs.writeFileSync` writes the file but worldline captures zero writes ("No
+/// file writes were captured"). Requires a real `node` on PATH; gated `#[ignore]`
+/// per the repo's Node-test convention and run in CI's `--ignored` step.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires node"]
+async fn captures_node_write_file_sync() {
+    let dir = tempfile::tempdir().unwrap();
+    let cwd = AbsolutePathBuf::new(dir.path().to_path_buf()).unwrap();
+    let ignore = IgnoreSet::new(cwd.clone(), true, &[]).unwrap();
+
+    let captured = run(RunOptions {
+        program: "node".into(),
+        args: vec!["-e".into(), "require('fs').writeFileSync('node-out.txt', 'HELLO-NODE')".into()],
+        cwd,
+        ignore,
+    })
+    .await
+    .expect("run worldline under node");
+
+    assert_eq!(captured.meta.exit_code, Some(0), "node should exit cleanly");
+
+    let api = reconstruct(&captured);
+    let w = api
+        .writes
+        .iter()
+        .find(|w| w.path.ends_with("node-out.txt"))
+        .expect("a captured write to node-out.txt (close$NOCANCEL must be intercepted)");
+    assert_eq!(text(&api, w.before.as_str()).as_deref(), Some(""), "before = empty (new file)");
+    assert_eq!(
+        text(&api, w.after.as_str()).as_deref(),
+        Some("HELLO-NODE"),
+        "after = the content node wrote"
+    );
+}