fix: keep the selftest workdir inside the fs scope on Windows

[f4nu]

What this is

Portability hardening for the selftest harness, not a bug fix — bun run selftest
passed 15/15 on Windows before this change. Found while tracing an unrelated fs-scope
failure.

The latent problem

makeWorkdir() in src/selftest/mount.tsx picked the selftest scratch directory as a
hardcoded POSIX path:

const dir = `/tmp/lopload-selftest-${Date.now()}-${…}`;

On Windows that path is drive-relative, not absolute: it resolves against the process's
current drive. With the repo checked out on D:, the selftest wrote to
D:\tmp\lopload-selftest-* — littering the drive root, and inside the capability scope
only by accident, because tauri canonicalises the /tmp/** pattern against that same
working drive. Move the checkout, or run with a different working drive, and the
reasoning behind the choice stops holding.

The original comment justified /tmp in Unix terms: the shipped scope allows /tmp/**
while the macOS temp dir (/var/folders/…) deliberately is not in scope, and the author
did not want to add a capability grant to the shipped app purely for tests. That
reasoning is correct on macOS/Linux and is preserved here.

What changed

src/selftest/mount.tsx, makeWorkdir() only:

const temp = await host.files.tempDir();
const onWindows = /^[A-Za-z]:/.test(temp);
const dir = await host.files.join(
  onWindows ? temp : "/tmp",
  `lopload-selftest-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
);

• On Windows the OS temp dir sits under the user profile, which the existing $HOME/**
  scope entry already covers; macOS/Linux keep /tmp for the reason above.
• Path building goes through the previously-unused host parameter
  (host.files.tempDir() / host.files.join()), so no new imports and nothing node-only
  enters the selftest module graph.
• No capability scope entry was added to the shipped app.
• The comment now states the actual rule — stay inside the shipped scope — instead of the
  Unix-only assumption.

Mixed separators still match: tauri 2.11.5's Scope::is_allowed normalises separators via
path.components().collect() (and canonicalises existing paths) before glob matching, so
the ${workdir}/${name} paths scenarios build are matched correctly against $HOME/**.

Verification

All on Windows, repo on D:, against the real MinIO on port 9400:

Check	Result
bun run typecheck	clean
bun test tests/unit	305 pass, 0 fail (40 files)
bun test tests/app.test.ts	16 pass, 0 fail
bun run selftest (Runner B, real Tauri binary)	SELFTEST_RESULT PASS total=15 passed=15 failed=0

Workdir location confirmed after the run: 15 fresh lopload-selftest-* directories (one
per scenario) under C:\Users\<user>\AppData\Local\Temp\, and no new directories in
D:\tmp.

Not verified on macOS or Linux; behaviour there is unchanged by construction (the
non-Windows branch is the previous code path).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 062648fa-c7ba-492d-90bd-2fc43d916218

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}