fix(agents): keep Windows checkouts and rendered docs platform-independent - #655

Both right, and both for the same reason: neither fix was reachable from hosted CI, so reverting either would have left every check green. Pushed fc56f87e, rebased onto 6347e7f2.

1 — the OpenCode package never ran

Confirmed: go list ./internal/agents returns one package, so the step never recursed into internal/agents/opencode and TestPluginFailsOpen never executed on Windows. The step now names it explicitly.

But naming it only helps if the runner actually converts line endings, and I would rather not have the guard depend on that. So I took the second option you offered as well — an explicit assertion — and split it in two, because the halves fail in different situations:

• byte half — reads the embedded assets and rejects a \r\n. Fires on any checkout that already converted.
• attribute half — asks git check-attr eol and requires lf. Fires on the removal itself, and is the half that still binds on a runner configured not to convert, where a byte assertion would pass whatever .gitattributes said.

It also covers internal/agents/pi/extension/index.ts, which is embedded the same way and had nothing watching it.

2 — the golden is in the wrong package to bind

Confirmed: TestAgentsRenderGolden is in cmd/gortex and the Windows job only builds that. Rather than add a step for a single test, I put the binding assertion next to the code, in internal/agents, which the job already runs. TestNormalizeRenderScrubsTheSlashSpelledPath hands the function a native home and root with a /-spelled body — the shape a renderer actually emits — and requires both to be scrubbed.

Happy to add the -run "^TestAgentsRenderGolden$" ./cmd/gortex step instead if you would rather have the end-to-end version on the runner; it is one line either way.

Sabotage, each independently — windows/amd64, go1.26.6

One of those was wrong the first time and it is worth recording: removing .gitattributes from the working tree alone proves nothing, because git falls back to the staged copy — the asset came back LF and the assertion passed. The attribute has to be removed from the index before the sabotage is real. I had used the working-tree-only version earlier in this PR and got a valid result then only because the file was still untracked at that point.

internal/agents           ok
internal/agents/opencode  ok

gofmt and go vet clean.

build-linux-static is red on infrastructure, not on this diff. It needs a re-run, which I cannot trigger from a fork.

The failing step is Run it where the dynamic build could not — the one that pulls debian:11 and alpine:3:

docker: Error response from daemon: received unexpected HTTP status: 502 Bad Gateway
##[error]Process completed with exit code 125

A registry 502 on docker run. Everything before it in the same job passed, including the actual subject of that job:

success  Build with the release link flags
success  Verify the binary is self-contained
success  Test the static-only code paths
failure  Run it where the dynamic build could not

This PR touches .gitattributes, two files under internal/agents, and the build-windows block of ci.yml — nothing that reaches the static link flags or the docker step.

The other eleven checks are green, and build-windows ran the new step:

success  Test Windows agent integrations      # now ./internal/agents ./internal/agents/opencode
success  Test native-separator store path comparisons

Both reproduced before fixing. Pushed 91bef013.

1 — the EOL test broke nested trees

Reproduced exactly as you described. Source copied to <outer-git>/src, .git removed from the copy:

embedded_asset_eol_test.go:43: internal/agents/opencode/plugin/gortex.js:
  open D:\tmp\nested\outer\internal\agents\opencode\plugin\gortex.js:
  The system cannot find the path specified.

git rev-parse --show-toplevel answered for the enclosing work tree, and the test then addressed files that were not there. Vendored copies, monorepo subdirectories and packaging staging trees all have that shape, so I broke go test in every one of them.

The root now comes from the nearest go.mod above the test's working directory, and the two halves are separated as you suggested:

• the byte assertion always runs, from the module root
• the attribute assertion runs only once the discovered git work tree is confirmed to be that same directory, and otherwise stands down with a logged reason

The identity check is os.SameFile, not string equality — git answers with forward slashes on Windows while filepath produces backslashes, and either side can arrive through a symlink or a different case.

Same nested reproduction after the fix:

--- PASS: TestEmbeddedTextAssetsArePinnedToLF
    module root D:\tmp\nested\outer2\src is not its own git work tree (<nil>);
    asserted the embedded bytes only, skipped the attribute half

TestModuleRootFromIgnoresAnEnclosingCheckout pins it, with an enclosing work tree and an enclosing go.mod, so neither a git lookup nor a careless upward walk passes by accident.

2 — the binary-path scrub was unguarded

Right: the test fed only home and root, so the third scrub target was never exercised and reverting that loop alone kept Windows green.

The test now pins gortexBinaryPaths to a known path and requires the slash-spelled executable to normalize to bare gortex. Pinning keeps the assertion about the scrub rather than about whatever gortex happens to be installed on the machine running it; no test in this package calls t.Parallel, so the swap cannot race one.

Sabotage, reverting only that loop to the native strings.ReplaceAll:

render_test.go:290: the slash-spelled executable survived normalizeRender
render_test.go:296: machine-specific absolute "/tools/bin/gortex" is still in the manifest

internal/agents           ok
internal/agents/opencode  ok

gofmt clean.

Separately: build-linux-static was red on the previous head from a Docker Hub 502 in the debian:11 pull, not from this diff — details in the comment above, in case the re-run is still needed.