test: fix Windows CI execution and resolve exposed platform failures

.github/workflows/ci.yml

@@ -175,10 +175,10 @@ jobs:
           NO_COLOR: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
-            npm run test:ci --workspace @google/gemini-cli
+            npm run test:ci --workspace "@google/gemini-cli"
           else
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
             npm run test:scripts
           fi
 
@@ -263,10 +263,10 @@ jobs:
           NO_COLOR: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
-            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
           else
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
             npm run test:scripts
           fi
 
@@ -429,11 +429,14 @@ jobs:
           NODE_ENV: 'test'
         run: |
           if ("${{ matrix.shard }}" -eq "cli") {
-            npm run test:ci --workspace @google/gemini-cli -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           } else {
             # Explicitly list non-cli packages to ensure they are sharded correctly
-            npm run test:ci --workspace @google/gemini-cli-core --workspace @google/gemini-cli-a2a-server --workspace gemini-cli-vscode-ide-companion --workspace @google/gemini-cli-test-utils --if-present -- --coverage.enabled=false
+            npm run test:ci --workspace "@google/gemini-cli-core" --workspace "@google/gemini-cli-a2a-server" --workspace "gemini-cli-vscode-ide-companion" --workspace "@google/gemini-cli-test-utils" --if-present -- --coverage.enabled=false
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
             npm run test:scripts
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         shell: 'pwsh'
 

packages/core/src/agents/auth-provider/api-key-provider.test.ts

@@ -6,10 +6,20 @@
 
 import { describe, it, expect, afterEach, vi } from 'vitest';
 import { ApiKeyAuthProvider } from './api-key-provider.js';
+import * as resolver from './value-resolver.js';
+
+vi.mock('./value-resolver.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('./value-resolver.js')>();
+  return {
+    ...actual,
+    resolveAuthValue: vi.fn(),
+  };
+});
 
 describe('ApiKeyAuthProvider', () => {
   afterEach(() => {
     vi.unstubAllEnvs();
+    vi.restoreAllMocks();
   });
 
   describe('initialization', () => {
@@ -26,6 +36,7 @@ describe('ApiKeyAuthProvider', () => {
 
     it('should resolve API key from environment variable', async () => {
       vi.stubEnv('TEST_API_KEY', 'env-api-key');
+      vi.mocked(resolver.resolveAuthValue).mockResolvedValue('env-api-key');
 
       const provider = new ApiKeyAuthProvider({
         type: 'apiKey',
@@ -38,6 +49,10 @@ describe('ApiKeyAuthProvider', () => {
     });
 
     it('should throw if environment variable is not set', async () => {
+      vi.mocked(resolver.resolveAuthValue).mockRejectedValue(
+        new Error("Environment variable 'MISSING_KEY_12345' is not set"),
+      );
+
       const provider = new ApiKeyAuthProvider({
         type: 'apiKey',
         key: '$MISSING_KEY_12345',
@@ -114,6 +129,8 @@ describe('ApiKeyAuthProvider', () => {
 
     it('should return undefined for env-var keys on 403', async () => {
       vi.stubEnv('RETRY_TEST_KEY', 'some-key');
+      vi.mocked(resolver.resolveAuthValue).mockResolvedValue('some-key');
+
       const provider = new ApiKeyAuthProvider({
         type: 'apiKey',
         key: '$RETRY_TEST_KEY',
@@ -128,9 +145,13 @@ describe('ApiKeyAuthProvider', () => {
     });
 
     it('should re-resolve and return headers for command keys on 401', async () => {
+      vi.mocked(resolver.resolveAuthValue)
+        .mockResolvedValueOnce('initial-key')
+        .mockResolvedValueOnce('refreshed-key');
+
       const provider = new ApiKeyAuthProvider({
         type: 'apiKey',
-        key: '!echo refreshed-key',
+        key: '!some command',
       });
       await provider.initialize();
 
@@ -142,9 +163,11 @@ describe('ApiKeyAuthProvider', () => {
     });
 
     it('should stop retrying after MAX_AUTH_RETRIES', async () => {
+      vi.mocked(resolver.resolveAuthValue).mockResolvedValue('rotating-key');
+
       const provider = new ApiKeyAuthProvider({
         type: 'apiKey',
-        key: '!echo rotating-key',
+        key: '!some command',
       });
       await provider.initialize();
 

packages/core/src/agents/auth-provider/value-resolver.test.ts

@@ -10,6 +10,16 @@ import {
   needsResolution,
   maskSensitiveValue,
 } from './value-resolver.js';
+import * as shellUtils from '../../utils/shell-utils.js';
+
+vi.mock('../../utils/shell-utils.js', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('../../utils/shell-utils.js')>();
+  return {
+    ...actual,
+    spawnAsync: vi.fn(),
+  };
+});
 
 describe('value-resolver', () => {
   describe('resolveAuthValue', () => {
@@ -39,12 +49,24 @@ describe('value-resolver', () => {
     });
 
     describe('shell commands', () => {
+      afterEach(() => {
+        vi.restoreAllMocks();
+      });
+
       it('should execute shell command with ! prefix', async () => {
+        vi.mocked(shellUtils.spawnAsync).mockResolvedValue({
+          stdout: 'hello\n',
+          stderr: '',
+        });
         const result = await resolveAuthValue('!echo hello');
         expect(result).toBe('hello');
       });
 
       it('should trim whitespace from command output', async () => {
+        vi.mocked(shellUtils.spawnAsync).mockResolvedValue({
+          stdout: '  hello  \n',
+          stderr: '',
+        });
         const result = await resolveAuthValue('!echo "  hello  "');
         expect(result).toBe('hello');
       });
@@ -56,16 +78,32 @@ describe('value-resolver', () => {
       });
 
       it('should throw error for command that returns empty output', async () => {
+        vi.mocked(shellUtils.spawnAsync).mockResolvedValue({
+          stdout: '',
+          stderr: '',
+        });
         await expect(resolveAuthValue('!echo -n ""')).rejects.toThrow(
           'returned empty output',
         );
       });
 
       it('should throw error for failed command', async () => {
+        vi.mocked(shellUtils.spawnAsync).mockRejectedValue(
+          new Error('Command failed'),
+        );
         await expect(
           resolveAuthValue('!nonexistent-command-12345'),
         ).rejects.toThrow(/Command.*failed/);
       });
+
+      it('should throw error for timeout', async () => {
+        const timeoutError = new Error('AbortError');
+        timeoutError.name = 'AbortError';
+        vi.mocked(shellUtils.spawnAsync).mockRejectedValue(timeoutError);
+        await expect(resolveAuthValue('!sleep 100')).rejects.toThrow(
+          /timed out after/,
+        );
+      });
     });
 
     describe('literal values', () => {

packages/core/src/agents/browser/browserManager.test.ts

@@ -154,7 +154,9 @@ describe('BrowserManager', () => {
         expect.objectContaining({
           command: 'node',
           args: expect.arrayContaining([
-            expect.stringMatching(/bundled\/chrome-devtools-mcp\.mjs$/),
+            expect.stringMatching(
+              /(dist[\\/])?bundled[\\/]chrome-devtools-mcp\.mjs$/,
+            ),
           ]),
         }),
       );
@@ -170,7 +172,7 @@ describe('BrowserManager', () => {
           command: 'node',
           args: expect.arrayContaining([
             expect.stringMatching(
-              /(dist\/)?bundled\/chrome-devtools-mcp\.mjs$/,
+              /(dist[\\/])?bundled[\\/]chrome-devtools-mcp\.mjs$/,
             ),
           ]),
         }),

packages/core/src/config/storage.test.ts

@@ -103,7 +103,7 @@ describe('Storage - Security', () => {
 });
 
 describe('Storage – additional helpers', () => {
-  const projectRoot = '/tmp/project';
+  const projectRoot = resolveToRealPath(path.resolve('/tmp/project'));
   const storage = new Storage(projectRoot);
 
   beforeEach(() => {
@@ -308,9 +308,9 @@ describe('Storage – additional helpers', () => {
       },
       {
         name: 'custom absolute path outside throws',
-        customDir: '/absolute/path/to/plans',
+        customDir: path.resolve('/absolute/path/to/plans'),
         expected: '',
-        expectedError: `Custom plans directory '/absolute/path/to/plans' resolves to '/absolute/path/to/plans', which is outside the project root '${resolveToRealPath(projectRoot)}'.`,
+        expectedError: `Custom plans directory '${path.resolve('/absolute/path/to/plans')}' resolves to '${path.resolve('/absolute/path/to/plans')}', which is outside the project root '${resolveToRealPath(projectRoot)}'.`,
       },
       {
         name: 'absolute path that happens to be inside project root',
@@ -349,15 +349,14 @@ describe('Storage – additional helpers', () => {
         setup: () => {
           vi.mocked(fs.realpathSync).mockImplementation((p: fs.PathLike) => {
             if (p.toString().includes('symlink-to-outside')) {
-              return '/outside/project/root';
+              return path.resolve('/outside/project/root');
             }
             return p.toString();
           });
           return () => vi.mocked(fs.realpathSync).mockRestore();
         },
         expected: '',
-        expectedError:
-          "Custom plans directory 'symlink-to-outside' resolves to '/outside/project/root', which is outside the project root '/tmp/project'.",
+        expectedError: `Custom plans directory 'symlink-to-outside' resolves to '${path.resolve('/outside/project/root')}', which is outside the project root '${resolveToRealPath(projectRoot)}'.`,
       },
     ];
 

packages/core/src/hooks/hookRunner.test.ts

@@ -513,7 +513,11 @@ describe('HookRunner', () => {
             const args = vi.mocked(spawn).mock.calls[
               executionOrder.length
             ][1] as string[];
-            const command = args[args.length - 1];
+            let command = args[args.length - 1];
+            // On Windows, the command is wrapped in PowerShell syntax
+            if (command.includes('; if ($LASTEXITCODE -ne 0)')) {
+              command = command.split(';')[0];
+            }
             executionOrder.push(command);
             setImmediate(() => callback(0));
           }