test(desktop): run the desktop unit suite on Windows

Exclude the suites for subsystems Windows builds do not ship, keep POSIX
mode-bit assertions to POSIX, and build expected paths with path.join.

Author: waleedlatif1

apps/desktop/src/main/browser-agent/file-transfer.test.ts

@@ -1,7 +1,7 @@
 import { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
 import { open, rename, rm, truncate } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { basename, join } from 'node:path'
 import { BROWSER_FILE_TRANSFER_MAX_BYTES } from '@sim/browser-protocol'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -59,7 +59,7 @@ describe('stageUploadFiles', () => {
       body: JSON.stringify({ toolCallId: 'call-1', index: 0 }),
       signal,
     })
-    expect(staged.map((path) => path.split('/').pop())).toEqual(['Q3 plan.pdf', 'granted.txt'])
+    expect(staged.map((path) => basename(path))).toEqual(['Q3 plan.pdf', 'granted.txt'])
     expect(readFileSync(staged[0], 'utf8')).toBe('workspace bytes')
     expect(readFileSync(staged[1], 'utf8')).toBe('local bytes')
     expect(staged.every((path) => path.startsWith(join(temp, 'sim-browser-uploads')))).toBe(true)
@@ -83,7 +83,7 @@ describe('stageUploadFiles', () => {
     })
 
     expect(staged.startsWith(join(temp, 'sim-browser-uploads'))).toBe(true)
-    expect(staged.endsWith('/evil')).toBe(true)
+    expect(basename(staged)).toBe('evil')
   })
 
   it('refuses a workspace file over the transfer ceiling', async () => {

apps/desktop/src/main/browser-agent/keyboard.test.ts

@@ -189,7 +189,7 @@ describe('dispatchKeyCombo', () => {
       .mockRejectedValueOnce(new Error('key-up response lost'))
       .mockRejectedValueOnce(new Error('cleanup unavailable'))
 
-    const dispatch = dispatchKeyCombo(contents, parseKeyCombo('Cmd+A'))
+    const dispatch = dispatchKeyCombo(contents, parseKeyCombo('Cmd+A', 'darwin'))
 
     await expect(dispatch).rejects.toEqual(
       expect.objectContaining({

apps/desktop/src/main/browser-credentials/vault.test.ts

@@ -86,7 +86,7 @@ describe('CredentialVault', () => {
     expect(JSON.parse(onDisk)).toMatchObject({ version: 1, ciphertext: expect.any(String) })
   })
 
-  it('writes the vault file owner-only', async () => {
+  it.skipIf(process.platform === 'win32')('writes the vault file owner-only', async () => {
     const vault = new CredentialVault(vaultPath, encryption())
     await vault.importCredentials(CANDIDATES, 'keep-existing')
 

apps/desktop/src/main/desktop-chat-session-store.test.ts

@@ -115,7 +115,8 @@ describe('DesktopChatSessionStore', () => {
     expect(onDisk).not.toContain('report.csv')
     expect(JSON.parse(onDisk)).toEqual({ v: 1, ciphertext: expect.any(String) })
     expect(provider.encryptString).toHaveBeenCalledOnce()
-    expect(statSync(filePath).mode & 0o077).toBe(0)
+    // POSIX mode bits; on Windows the per-user %APPDATA% ACL keeps the file private.
+    if (process.platform !== 'win32') expect(statSync(filePath).mode & 0o077).toBe(0)
   })
 
   it('does not replace the durable store with an oversized encrypted envelope', () => {

apps/desktop/src/main/desktop-executor/runner.test.ts

@@ -191,7 +191,7 @@ describe('local file calls', () => {
   })
 })
 
-describe('background imports', () => {
+describe.skipIf(process.platform === 'win32')('background imports', () => {
   const roots: string[] = []
 
   afterEach(async () => {

apps/desktop/src/main/desktop-executor/service.test.ts

@@ -337,20 +337,25 @@ describe('desktop executor registration', () => {
     }
   })
 
-  it('registers with no install id it could not save', async () => {
-    const userData = await mkdtemp(join(tmpdir(), 'sim-executor-service-'))
-    await chmod(userData, 0o500)
-    try {
-      const { sim, desktopExecutor } = await service(1, userData)
-
-      desktopExecutor.start()
-      await sleep(200)
-
-      expect(sim.requests.filter((request) => request.includes('/api/desktop/devices'))).toEqual([])
-    } finally {
-      await chmod(userData, 0o700)
+  it.skipIf(process.platform === 'win32')(
+    'registers with no install id it could not save',
+    async () => {
+      const userData = await mkdtemp(join(tmpdir(), 'sim-executor-service-'))
+      await chmod(userData, 0o500)
+      try {
+        const { sim, desktopExecutor } = await service(1, userData)
+
+        desktopExecutor.start()
+        await sleep(200)
+
+        expect(sim.requests.filter((request) => request.includes('/api/desktop/devices'))).toEqual(
+          []
+        )
+      } finally {
+        await chmod(userData, 0o700)
+      }
     }
-  })
+  )
 
   it('keeps its install id through a read failure instead of minting a new one', async () => {
     const userData = await mkdtemp(join(tmpdir(), 'sim-executor-service-'))

apps/desktop/src/main/downloads.test.ts

@@ -45,7 +45,7 @@ describe('uniqueDownloadPath', () => {
     ])
 
     expect(new Set([first, second])).toEqual(
-      new Set(['/Downloads/report.csv', '/Downloads/report (copy-1).csv'])
+      new Set([join('/Downloads', 'report.csv'), join('/Downloads', 'report (copy-1).csv')])
     )
   })
 })

apps/desktop/src/main/ipc.test.ts

@@ -418,8 +418,9 @@ describe('registerIpcHandlers', () => {
 
     expect(await handler?.(evilEvent)).toBe(false)
     expect(await handler?.(appEvent)).toBe(false)
-    expect(await handler?.(activeAppEvent)).toBe(process.platform === 'darwin')
-    expect(shell.openExternal).toHaveBeenCalledTimes(process.platform === 'darwin' ? 1 : 0)
+    const hasPrivacySettings = process.platform === 'darwin' || process.platform === 'win32'
+    expect(await handler?.(activeAppEvent)).toBe(hasPrivacySettings)
+    expect(shell.openExternal).toHaveBeenCalledTimes(hasPrivacySettings ? 1 : 0)
   })
 
   it('restricts the OAuth connect handoff to an activated app origin', async () => {

apps/desktop/src/main/observability.test.ts

@@ -26,31 +26,37 @@ describe('scrubUrl', () => {
 })
 
 describe('createEventLog', () => {
-  it('creates its directory and log with private permissions', () => {
-    const root = mkdtempSync(join(tmpdir(), 'sim-desktop-events-'))
-    const dir = join(root, 'logs')
-    const events = createEventLog(dir)
-    events.record('app_launch')
+  it.skipIf(process.platform === 'win32')(
+    'creates its directory and log with private permissions',
+    () => {
+      const root = mkdtempSync(join(tmpdir(), 'sim-desktop-events-'))
+      const dir = join(root, 'logs')
+      const events = createEventLog(dir)
+      events.record('app_launch')
 
-    expect(statSync(dir).mode & 0o777).toBe(0o700)
-    expect(statSync(events.filePath).mode & 0o777).toBe(0o600)
-  })
+      expect(statSync(dir).mode & 0o777).toBe(0o700)
+      expect(statSync(events.filePath).mode & 0o777).toBe(0o600)
+    }
+  )
 
-  it('reports permission failures without exposing local paths or OS errors', () => {
-    const root = mkdtempSync(join(tmpdir(), 'sim-desktop-events-'))
-    const overlongDir = join(root, 'x'.repeat(300))
+  it.skipIf(process.platform === 'win32')(
+    'reports permission failures without exposing local paths or OS errors',
+    () => {
+      const root = mkdtempSync(join(tmpdir(), 'sim-desktop-events-'))
+      const overlongDir = join(root, 'x'.repeat(300))
 
-    const events = createEventLog(overlongDir)
-    events.record('app_launch')
+      const events = createEventLog(overlongDir)
+      events.record('app_launch')
 
-    expect(mockLogger.warn.mock.calls).toEqual([
-      ['Could not apply private desktop event-log permissions', { target: 'directory' }],
-      ['Could not apply private desktop event-log permissions', { target: 'current-log' }],
-      ['Could not apply private desktop event-log permissions', { target: 'rotated-log' }],
-    ])
-    expect(JSON.stringify(mockLogger.warn.mock.calls)).not.toContain(root)
-    expect(JSON.stringify(mockLogger.warn.mock.calls)).not.toContain('ENAMETOOLONG')
-  })
+      expect(mockLogger.warn.mock.calls).toEqual([
+        ['Could not apply private desktop event-log permissions', { target: 'directory' }],
+        ['Could not apply private desktop event-log permissions', { target: 'current-log' }],
+        ['Could not apply private desktop event-log permissions', { target: 'rotated-log' }],
+      ])
+      expect(JSON.stringify(mockLogger.warn.mock.calls)).not.toContain(root)
+      expect(JSON.stringify(mockLogger.warn.mock.calls)).not.toContain('ENAMETOOLONG')
+    }
+  )
 })
 
 describe('installMainProcessFailureObservers', () => {

apps/desktop/vitest.config.ts

@@ -8,7 +8,18 @@ export default mergeConfig(
     test: {
       setupFiles: ['src/test/setup.ts'],
       include: ['src/**/*.test.ts'],
-      exclude: ['**/e2e/**'],
+      // These suites drive subsystems Windows builds do not ship (tmux, the macOS computer-use
+      // helper, the POSIX native file module); see src/shared/platform-features.ts.
+      exclude: [
+        '**/e2e/**',
+        ...(process.platform === 'win32'
+          ? [
+              'src/main/terminal/tmux.test.ts',
+              'src/main/computer-use/native-client.test.ts',
+              'src/main/local-files.test.ts',
+            ]
+          : []),
+      ],
       pool: 'threads',
       testTimeout: 10000,
     },