Merge main into phase 4 installer migrations

tests/bug-2771-user-profile-manifest.test.cjs

@@ -22,6 +22,7 @@ const { describe, test, beforeEach, afterEach, before } = require('node:test');
 const assert = require('node:assert/strict');
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { execFileSync } = require('child_process');
 const { createTempDir, cleanup } = require('./helpers.cjs');
 
@@ -262,4 +263,44 @@ describe('manifest path safety', () => {
     assert.equal(fs.readFileSync(outside, 'utf8'), 'outside user data\n');
     assert.equal(fs.existsSync(path.join(tmpDir, PATCHES_DIR_NAME, '..', path.basename(outside))), false);
   });
+
+  test('saveLocalPatches does not follow symlinked patch directories outside the install root', () => {
+    const origMode = process.env.GSD_TEST_MODE;
+    process.env.GSD_TEST_MODE = '1';
+    let mod;
+    try {
+      delete require.cache[require.resolve(INSTALL_SCRIPT)];
+      mod = require(INSTALL_SCRIPT);
+    } finally {
+      if (origMode === undefined) delete process.env.GSD_TEST_MODE;
+      else process.env.GSD_TEST_MODE = origMode;
+    }
+
+    const hookPath = path.join(tmpDir, 'hooks', 'managed.js');
+    fs.mkdirSync(path.dirname(hookPath), { recursive: true });
+    fs.writeFileSync(hookPath, 'user edited hook\n', 'utf8');
+    fs.writeFileSync(
+      path.join(tmpDir, MANIFEST_NAME),
+      JSON.stringify({
+        version: 'legacy',
+        timestamp: '2026-05-11T00:00:00.000Z',
+        files: {
+          'hooks/managed.js': crypto.createHash('sha256').update('managed hook\n').digest('hex'),
+        },
+      }, null, 2),
+      'utf8'
+    );
+
+    fs.mkdirSync(outside, { recursive: true });
+    try {
+      fs.symlinkSync(outside, path.join(tmpDir, PATCHES_DIR_NAME), 'dir');
+    } catch {
+      return;
+    }
+
+    const modified = mod.saveLocalPatches(tmpDir);
+
+    assert.deepEqual(modified, []);
+    assert.equal(fs.existsSync(path.join(outside, 'hooks', 'managed.js')), false);
+  });
 });

tests/installer-migrations.test.cjs

@@ -665,6 +665,58 @@ test('reports lock release failures after migration work completes', (t) => {
   );
 });
 
+test('rollback handle restores files and install state after a successful apply', () => {
+  const configDir = createTempInstall();
+  try {
+    writeFile(configDir, 'hooks/old-hook.js', 'managed hook\n');
+    writeManifest(configDir, {
+      'hooks/old-hook.js': sha256('managed hook\n'),
+    });
+    writeInstallState(configDir, {
+      schemaVersion: 1,
+      appliedMigrations: [
+        {
+          id: 'already-applied',
+          appliedAt: '2026-05-10T00:00:00.000Z',
+          journal: 'gsd-migration-journal/prior.json',
+        },
+      ],
+    });
+
+    const plan = planInstallerMigrations({
+      configDir,
+      migrations: [
+        {
+          id: '2026-05-11-remove-old-hook',
+          description: 'Remove retired hook',
+          plan: () => [
+            {
+              type: 'remove-managed',
+              relPath: 'hooks/old-hook.js',
+              reason: 'retired hook',
+            },
+          ],
+        },
+      ],
+      now: () => '2026-05-11T00:00:00.000Z',
+    });
+
+    const result = applyInstallerMigrationPlan({
+      configDir,
+      plan,
+      now: () => '2026-05-11T00:00:01.000Z',
+    });
+
+    result.rollback();
+
+    assert.equal(fs.readFileSync(path.join(configDir, 'hooks/old-hook.js'), 'utf8'), 'managed hook\n');
+    assert.deepEqual(readInstallState(configDir).appliedMigrations.map((entry) => entry.id), ['already-applied']);
+    assert.equal(fs.existsSync(path.join(configDir, result.journalRelPath)), false);
+  } finally {
+    cleanup(configDir);
+  }
+});
+
 test('rolls back touched files and leaves state unchanged when apply fails', () => {
   const configDir = createTempInstall();
   try {