From 4d0effbecf82d7446cf56c9b07b2c69f886eff34 Mon Sep 17 00:00:00 2001
From: localai-org-maint-bot
 <306269227+localai-org-maint-bot@users.noreply.github.com>
Date: Tue, 8 Sep 2026 03:08:43 +0000
Subject: [PATCH] test(worker): canonicalize missing upload fixture

Resolve the existing model directory before choosing a missing file. On
macOS, resolving the missing leaf fails and otherwise compares an aliased
path with a canonical allowed directory. Keep this test on the Upload
error branch instead of the containment rejection branch.

Assisted-by: Codex:GPT-6
---
 core/services/worker/control_files_test.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/core/services/worker/control_files_test.go b/core/services/worker/control_files_test.go
index 0668e2de6..b45b44199 100644
--- a/core/services/worker/control_files_test.go
+++ b/core/services/worker/control_files_test.go
@@ -176,7 +176,11 @@ var _ = Describe("worker file-staging control routes", func() {
 		// allow-list. The two are separate statements of the same rule inside
 		// one handler, and a spec that only ever reaches the allow-list leaves
 		// the upload free to answer 500 for the worker's own verdict.
-		missing := filepath.Join(modelsDir, "was-never-written.bin")
+		// A missing file cannot resolve symlinked parents such as macOS /var.
+		// Use the canonical root so this tests Upload's error, not containment.
+		resolvedModelsDir, err := filepath.EvalSymlinks(modelsDir)
+		Expect(err).NotTo(HaveOccurred())
+		missing := filepath.Join(resolvedModelsDir, "was-never-written.bin")
 		resp := post(workerctl.PathFilesStage, map[string]string{"local_path": missing, "key": "data/x"})
 		Expect(resp.StatusCode).To(Equal(http.StatusOK))
 		var reply struct {