test(adoption): cover the agent-bash-tool embedding shape, on Windows too (#2249)

The composition an embedder actually writes — realfs workspace mount +
CommandResolver bridging unresolved names to host processes + HostMounts
mapping the cwd back — was only ever validated downstream. The first
adopter shipped two defects bashkit's tests could not see: a harness that
emptied PATH, and a stdin pipe that never reached EOF and hung the suite.

Add thirdparty_adoption_tests covering that composition end to end. The
stdin test was verified by injecting the EOF defect: it first passed
(proving the test was wrong — it used `cat`, a bashkit builtin, so the
bridge never ran), then hung, and only after bounding the bridge's wait
and guarding the pipe drain does it report a named 20s failure instead of
a hung job.

Add a windows-latest job running these suites, and gate Check on it and
on the existing windows-containment job, which was never wired into the
gate and so could not block a merge.

Gate harness_example_tests on cfg(unix): it uses std::os::unix, which
broke the integration binary's Windows compile.

Author: chaliy

.github/workflows/ci.yml

@@ -218,6 +218,11 @@ jobs:
       - name: Run realfs tests
         run: cargo test --features realfs -p bashkit --test realfs_tests -p bashkit-cli
 
+      # The third-party adoption and host-mount suites are `cfg(realfs)`, so
+      # the main "Run tests" step (no realfs) compiles them out entirely.
+      - name: Run realfs integration tests
+        run: cargo test -p bashkit --test integration --features realfs -- host_mounts_tests thirdparty_adoption_tests
+
       - name: Run fail-point tests (single-threaded)
         run: cargo test --features failpoints --test security_failpoint_tests -- --test-threads=1
 
@@ -247,6 +252,33 @@ jobs:
       - name: Test RealFS and overlay containment
         run: cargo test -p bashkit --test realfs_tests --features realfs windows_containment
 
+  # The adoption shape this covers — bashkit as an agent's shell, with commands
+  # bridged to host processes — exists to work on Windows without a real bash.
+  # Kept separate from `windows-containment`: that job pins path-containment
+  # semantics (TM-ESC-033), this one pins the embedding contract. Scoped to the
+  # adoption suites rather than the whole workspace.
+  test-windows:
+    name: Test (Windows adoption shape)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          shared-key: windows-adoption
+
+      - name: Run third-party adoption tests
+        run: cargo test -p bashkit --test integration --features realfs -- thirdparty_adoption_tests
+
+      - name: Run host mount mapping tests
+        run: cargo test -p bashkit --test integration --features realfs -- host_mounts_tests
+
+      - name: Run command resolver tests
+        run: cargo test -p bashkit --test integration -- command_resolver_tests
+
   examples:
     name: Examples
     runs-on: ubuntu-latest
@@ -377,14 +409,16 @@ jobs:
   check:
     name: Check
     if: always()
-    needs: [lint, audit, test, examples, fuzz-check]
+    needs: [lint, audit, test, windows-containment, test-windows, examples, fuzz-check]
     runs-on: ubuntu-latest
     steps:
       - name: Verify all jobs passed
         run: |
           if [[ "${{ needs.lint.result }}" != "success" ]] || \
              [[ "${{ needs.audit.result }}" != "success" ]] || \
              [[ "${{ needs.test.result }}" != "success" ]] || \
+             [[ "${{ needs.windows-containment.result }}" != "success" ]] || \
+             [[ "${{ needs.test-windows.result }}" != "success" ]] || \
              [[ "${{ needs.examples.result }}" != "success" ]] || \
              [[ "${{ needs.fuzz-check.result }}" != "success" ]]; then
             echo "One or more required jobs failed"

crates/bashkit/tests/integration/harness_example_tests.rs

@@ -1,3 +1,8 @@
+//! Unix-only: uses `std::os::unix` (file modes, symlinks). The integration
+//! binary is built on Windows by the `Test (Windows adoption shape)` job, so
+//! this module must gate itself out rather than break that compile.
+#![cfg(unix)]
+
 use std::fs;
 use std::os::unix::fs::{PermissionsExt, symlink};
 use std::path::Path;

crates/bashkit/tests/integration/main.rs

@@ -107,6 +107,7 @@ pub mod sqlite_security_tests;
 pub mod stack_overflow_regression_tests;
 pub mod subst_depth_limit_tests;
 pub mod symlink_overlay_security_tests;
+pub mod thirdparty_adoption_tests;
 pub mod threat_model_doc_tests;
 pub mod threat_model_tests;
 pub mod time_command_tests;