test(desktop): verify session launch reviews, cleanup, and account isolation

crates/switchyard-desktop/src/controller.rs

@@ -1553,6 +1553,169 @@ fn update(settings: &std::path::Path) -> Result<String, String> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    // The subprocess isolates harness discovery and every launch destination.
+    #[cfg(unix)]
+    #[test]
+    fn session_launch_requires_an_unchanged_review_before_creating_files() {
+        use std::os::unix::fs::PermissionsExt;
+        use std::{fs, process::Command};
+        if let Some(home) = std::env::var_os("SWITCHYARD_LAUNCH_REVIEW_FIXTURE") {
+            let home = PathBuf::from(home);
+            let project = home.join("project");
+            let git = |args: &[&str]| {
+                let result = Command::new("/usr/bin/git")
+                    .arg("-C")
+                    .arg(&project)
+                    .args(args)
+                    .output()
+                    .expect("git");
+                assert!(
+                    result.status.success(),
+                    "{}",
+                    String::from_utf8_lossy(&result.stderr)
+                );
+            };
+            fs::create_dir(&project).expect("project");
+            git(&["init"]);
+            git(&[
+                "-c",
+                "user.name=Fixture",
+                "-c",
+                "user.email=fixture@example.test",
+                "-c",
+                "commit.gpgsign=false",
+                "commit",
+                "--allow-empty",
+                "-m",
+                "initial",
+            ]);
+            let settings = home.join("desktop.toml");
+            let server = home.join("server.toml");
+            let text = "[llm_clients.c]\n\
+                        base_url='http://localhost:1234'\n\
+                        [targets.m]\n\
+                        id='actual'\n\
+                        llm_client='c'\n\
+                        [routes.r]\n\
+                        id='public'\n\
+                        type='passthrough'\n\
+                        target='m'\n";
+            fs::write(&server, text).expect("server");
+            fs::write(
+                &settings,
+                format!(
+                    "config_file={server:?}\nrouting_log={:?}\n",
+                    home.join("routing.jsonl")
+                ),
+            )
+            .expect("settings");
+            let mut controller =
+                Controller::new(Config::load(&settings).expect("settings"), settings.clone());
+            let preview = |controller: &mut Controller| {
+                controller
+                    .dispatch(Action::PreviewLaunch {
+                        tool: Harness::CodexCli,
+                        account: None,
+                        route: "r".into(),
+                        id: "public".into(),
+                        project: project.display().to_string(),
+                    })
+                    .expect("preview")
+            };
+            let launch = |token: Option<String>, path: String| Action::Launch {
+                tool: Harness::CodexCli,
+                account: None,
+                route: "r".into(),
+                id: "public".into(),
+                project: path,
+                preview_token: token,
+            };
+            let reviewed = preview(&mut controller);
+            let token = reviewed.data["preview_token"]
+                .as_str()
+                .expect("token")
+                .to_string();
+            for rejected in [
+                launch(None, project.display().to_string()),
+                launch(Some("wrong".into()), project.display().to_string()),
+                launch(Some(token.clone()), home.display().to_string()),
+            ] {
+                assert!(controller.dispatch(rejected).is_err());
+            }
+            fs::write(&server, format!("{text}# external edit\n")).expect("edit");
+            assert!(
+                controller
+                    .dispatch(launch(Some(token), project.display().to_string()))
+                    .is_err()
+            );
+            assert_eq!(
+                fs::read_to_string(&server).expect("preserved"),
+                format!("{text}# external edit\n")
+            );
+            let reviewed = preview(&mut controller);
+            let token = reviewed.data["preview_token"]
+                .as_str()
+                .expect("token")
+                .to_string();
+            let original = fs::read_to_string(&settings).expect("settings");
+            fs::write(&settings, format!("{original}# external settings\n")).expect("edit");
+            assert!(
+                controller
+                    .dispatch(launch(Some(token), project.display().to_string()))
+                    .is_err()
+            );
+            let reviewed = preview(&mut controller);
+            let token = reviewed.data["preview_token"]
+                .as_str()
+                .expect("token")
+                .to_string();
+            git(&[
+                "-c",
+                "user.name=Fixture",
+                "-c",
+                "user.email=fixture@example.test",
+                "-c",
+                "commit.gpgsign=false",
+                "commit",
+                "--allow-empty",
+                "-m",
+                "changed",
+            ]);
+            assert!(
+                controller
+                    .dispatch(launch(Some(token), project.display().to_string()))
+                    .err()
+                    .expect("changed HEAD")
+                    .contains("project changed")
+            );
+            assert!(!home.join(".switchyard/worktrees").exists());
+            assert!(!home.join("terminal-called").exists());
+            assert_eq!(fs::read_dir(&home).expect("files").count(), 4);
+            return;
+        }
+        let home = tempfile::tempdir().expect("fixture");
+        let bin = home.path().join("bin");
+        fs::create_dir(&bin).expect("bin");
+        for name in ["codex", "open", "osascript"] {
+            let path = bin.join(name);
+            fs::write(
+                &path,
+                "#!/bin/sh\ntouch \"$HOME/terminal-called\"\nexit 0\n",
+            )
+            .expect("stub");
+            fs::set_permissions(path, fs::Permissions::from_mode(0o755)).expect("executable");
+        }
+        let output=Command::new(std::env::current_exe().expect("test binary"))
+            .args(["--exact", "controller::tests::session_launch_requires_an_unchanged_review_before_creating_files"])
+            .env("SWITCHYARD_LAUNCH_REVIEW_FIXTURE",home.path()).env("HOME",home.path())
+            .env("PATH",format!("{}:/usr/bin:/bin",bin.display())).output().expect("child");
+        assert!(
+            output.status.success(),
+            "{}\n{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
     #[test]
     // An algorithm switch must not give stale choices a revision for externally edited bytes.
     fn algorithm_switches_keep_the_first_revision_and_external_edits_reject_it() {