test_rejects_symlink_outside_bundle fails on Windows without symlink privilege #7393

Component: Plugin (integrations/agent-plugin-core)

Summary

test_rejects_symlink_outside_bundle in integrations/agent-plugin-core/tests/test_validate.py errors during setup on Windows for any user without elevation or Developer Mode. It is the only failure in that file.

Line 49 on main creates the symlink unconditionally:

(bundle / "skills").symlink_to(outside, target_is_directory=True)

Creating a symlink on Windows needs SeCreateSymbolicLinkPrivilege, which an ordinary user account does not hold.

Steps to Reproduce

On Windows, non-elevated, Developer Mode off:

git clone https://github.com/mem0ai/mem0
cd mem0/integrations/agent-plugin-core
pip install -r requirements-dev.txt
python -m pytest tests/test_validate.py -q

Expected Behavior

Either the test passes, or it skips where the platform cannot create the symlink it needs to set itself up.

Actual Behavior

    def test_rejects_symlink_outside_bundle(tmp_path: Path) -> None:
        bundle = tmp_path / "plugin"
        write_manifest(bundle)
        outside = tmp_path / "outside"
        outside.mkdir()
>       (bundle / "skills").symlink_to(outside, target_is_directory=True)

tests\test_validate.py:49:
...
>       os.symlink(target, self, target_is_directory)
E       OSError: [WinError 1314] A required privilege is not held by the client

=========================== short test summary info ===========================
FAILED tests/test_validate.py::test_rejects_symlink_outside_bundle - OSError:...
1 failed, 5 passed in 4.60s

Environment

• mem0 at a39a802 (main, 2026-09-18)
• Python 3.14, Windows 11 (10.0.26200), non-elevated, Developer Mode off
• integrations/agent-plugin-core only

How You Verified This

What I Ran

python -m pytest tests/test_validate.py -q in integrations/agent-plugin-core, on a real unprivileged Windows 11 machine, with requirements-dev.txt installed.

What I Saw

1 failed, 5 passed, the traceback above. Guarding only the setup call:

try:
    (bundle / "skills").symlink_to(outside, target_is_directory=True)
except OSError as exc:
    pytest.skip(f"symlink creation unavailable: {exc}")

turns the same run into 5 passed, 1 skipped. Every assertion in the test is untouched, so it still exercises the validator's symlink rejection wherever symlinks can be created — which includes CI.

Why This Is a Bug

The test asserts that the validator rejects a bundle whose skills is a symlink pointing outside. That behaviour is worth testing. But the test's setup needs a privilege the platform may not grant, and an OSError in setup is a failure, not a skip.

agent-plugins-python-checks.yml runs ubuntu-latest only, so nothing in CI covers Windows for this package and nothing there could have surfaced it. The person who hits it is a Windows contributor running the suite locally — who, in my experience of this exact failure across a dozen projects, assumes their own machine is misconfigured and never files it.

WinError 1314 is worth one specific note: it is a plain OSError, not a subclass, so except FileExistsError or contextlib.suppress(FileExistsError) will not catch it. It has to be OSError.

Note on the closed PR

I opened #7388 with this fix before reading the gate rules; pr-gate closed it ten seconds later, correctly, because there was no agreed issue. Filing that issue now. If you want the fix, the branch is ready and reopening takes a click — or I am happy for someone else to take it.