From 5feb265f8412ba4ea5d494448aa41aa3fcbe0905 Mon Sep 17 00:00:00 2001
From: nivokvo <nivokvo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 14:38:18 +0300
Subject: [PATCH] fix: dns enable/disable drop-in tests ran their subject only
 on linux
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

dnsCommand() called detectPlatform() directly and gated every
drop-in-dependent branch on platform === 'linux'. On any other OS the
gates were dead: injected dropins were never consulted, foreign
detection returned nothing, captureRestorePoint skipped its files — so
eight enable/disable tests failed on macOS (and would on Windows) while
passing in CI on ubuntu.

Everything else in that decision tree is already injectable 'so the
decision logic is testable without a resolver, a root shell or a
machine whose DNS is a real thing to break' — platform now follows the
same rule. Tests pin platform: () => 'linux' in noSystem(), which is
the host shape their fixtures were built for. No product behavior
changed: the default remains the real detected platform.
---
 src/dns.mjs                       | 7 ++++++-
 test/dns-disable-restore.test.mjs | 4 ++++
 test/dns-enable-rollback.test.mjs | 4 ++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/dns.mjs b/src/dns.mjs
index d6c6944..72bf653 100644
--- a/src/dns.mjs
+++ b/src/dns.mjs
@@ -2325,6 +2325,11 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     readManifest = async (path) => parseManifest(await defaultReadMaybe(path)),
     uid = typeof process.getuid === "function" ? process.getuid() : 0,
     escalate = escalateSelf,
+    // Injected for the same reason as everything above: the enable/disable
+    // decision tree reads the host's drop-ins only on linux/systemd-resolved,
+    // and a test running on any other OS must be able to say "linux" without
+    // lying about the machine it is on.
+    platform: platformImpl = detectPlatform,
   } = deps;
   const [sub, ...rest] = args;
   const flag = (name, fallback) => {
@@ -2595,7 +2600,7 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
   }
 
   if (sub === "enable" || sub === "disable") {
-    const platform = detectPlatform();
+    const platform = platformImpl();
     if (!platform) {
       out(`unsupported platform: ${process.platform}`);
       return 1;
diff --git a/test/dns-disable-restore.test.mjs b/test/dns-disable-restore.test.mjs
index 04aa338..f769312 100644
--- a/test/dns-disable-restore.test.mjs
+++ b/test/dns-disable-restore.test.mjs
@@ -298,6 +298,10 @@ let lastVerifyArgs = null;
 
 function noSystem() {
   return {
+    // The enable/disable tree reads host drop-ins only on linux +
+    // systemd-resolved; pinning the platform makes those paths deterministic
+    // on a Mac or Windows checkout instead of silently skipped.
+    platform: () => "linux",
     tlds: async () => ["eggs", "hacker"],
     safety: async () => ({ safe: true, upstreams: ["1.1.1.1"], why: "" }),
     preflight: async () => ({ ok: true, blockers: [], conflicts: [], duplicates: [], holder: null }),
diff --git a/test/dns-enable-rollback.test.mjs b/test/dns-enable-rollback.test.mjs
index 996c812..8e16e14 100644
--- a/test/dns-enable-rollback.test.mjs
+++ b/test/dns-enable-rollback.test.mjs
@@ -449,6 +449,10 @@ test("--dry-run still reports a preflight that would refuse", async () => {
 /** Every system call `enable` makes, stubbed to a machine where nothing is wrong. */
 function noSystem() {
   return {
+    // The enable tree consults host drop-ins only on linux +
+    // systemd-resolved; pinning the platform keeps those paths testable from
+    // any OS the suite runs on.
+    platform: () => "linux",
     tlds: async () => ["eggs", "hacker"],
     safety: async () => ({ safe: true, upstreams: ["1.1.1.1"], why: "no bridge is running yet — this one will be ours" }),
     preflight: async () => ({ ok: true, blockers: [], conflicts: [], holder: null }),