Fix Go FFI inprocess e2e CI failures

Resolve the remaining inprocess-cell failures in the go-sdk-tests matrix:

- Anchor all repo-relative test paths to source dirs, not the process cwd.
  The in-process transport os.Chdir's the whole test process into a per-test
  temp workdir, so cwd-relative resolution of the replay proxy (server.ts) and
  MCP server scripts (*.mjs) broke for every test after the first in-process
  one. Add testharness.RepoPath and use it for the proxy, CLI, and MCP paths.

- Fix a data race in ffihost.Host: `disposed` was written under disposeMu but
  read under callbackMu. Unify all disposed/serverID/connectionID/activeCallbacks
  access under a single mutex, which also fixes a real drain-ordering bug where a
  late onOutbound callback could feed the receive buffer after it was closed.

- Re-arm foreign signal handlers with SA_ONSTACK on linux too (not just darwin).
  libuv's SA_ONSTACK-less SIGCHLD handler makes the Go runtime abort when the
  test process reaps its own os/exec child (e.g. an MCP OAuth server) while
  libnode is loaded. Resolve sigaction through the runtime handle (with a libc
  dlopen fallback).

- Make the OAuth MCP server's stderr buffer thread-safe (syncBuffer): os/exec
  writes to it on a goroutine while the test reads String(), a -race violation.

- Skip only the readCheckpoint "unknown checkpoint" scenario in-process, where
  the native runtime decodes the id as u32 and rejects the large sentinel,
  matching Rust's explicit skip.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a96d1a82-c80e-40f1-a3df-a9708429b68b

Author: SteveSandersonMS

go/internal/e2e/mcp_and_agents_e2e_test.go

@@ -115,10 +115,7 @@ func TestMCPServersE2E(t *testing.T) {
 	t.Run("should pass literal env values to MCP server subprocess", func(t *testing.T) {
 		ctx.ConfigureForTest(t)
 
-		mcpServerPath, err := filepath.Abs("../../../test/harness/test-mcp-server.mjs")
-		if err != nil {
-			t.Fatalf("Failed to resolve test-mcp-server path: %v", err)
-		}
+		mcpServerPath := testharness.RepoPath("test", "harness", "test-mcp-server.mjs")
 		mcpServerDir := filepath.Dir(mcpServerPath)
 
 		mcpServers := map[string]copilot.MCPServerConfig{

go/internal/e2e/mcp_oauth_e2e_test.go

@@ -6,7 +6,6 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"slices"
 	"strings"
 	"sync"
@@ -306,17 +305,14 @@ type oauthMCPRequest struct {
 func startOAuthMCPServer(t *testing.T) string {
 	t.Helper()
 
-	serverPath, err := filepath.Abs("../../../test/harness/test-mcp-oauth-server.mjs")
-	if err != nil {
-		t.Fatalf("Failed to resolve OAuth MCP server path: %v", err)
-	}
+	serverPath := testharness.RepoPath("test", "harness", "test-mcp-oauth-server.mjs")
 	cmd := exec.Command("node", serverPath)
 	cmd.Env = append(os.Environ(), "EXPECTED_TOKEN="+expectedMCPOAuthToken)
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		t.Fatalf("Failed to pipe OAuth MCP server stdout: %v", err)
 	}
-	var stderr strings.Builder
+	var stderr syncBuffer
 	cmd.Stderr = &stderr
 	if err := cmd.Start(); err != nil {
 		t.Fatalf("Failed to start OAuth MCP server: %v", err)
@@ -362,6 +358,26 @@ func stringValue(value *string) string {
 	return *value
 }
 
+// syncBuffer is a minimal io.Writer whose contents can be read concurrently.
+// os/exec writes to cmd.Stderr on a separate goroutine, so reading a plain
+// strings.Builder while the process is running is a data race (caught by -race).
+type syncBuffer struct {
+	mu  sync.Mutex
+	buf strings.Builder
+}
+
+func (b *syncBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.Write(p)
+}
+
+func (b *syncBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.String()
+}
+
 func fetchOAuthMCPRequests(t *testing.T, baseURL string) []oauthMCPRequest {
 	t.Helper()
 

go/internal/e2e/mcp_server_helpers_test.go

@@ -8,16 +8,14 @@ import (
 	"time"
 
 	copilot "github.com/github/copilot-sdk/go"
+	"github.com/github/copilot-sdk/go/internal/e2e/testharness"
 	"github.com/github/copilot-sdk/go/rpc"
 )
 
 func testMCPServers(t *testing.T, serverNames ...string) map[string]copilot.MCPServerConfig {
 	t.Helper()
 
-	mcpServerPath, err := filepath.Abs("../../../test/harness/test-mcp-server.mjs")
-	if err != nil {
-		t.Fatalf("Failed to resolve test-mcp-server path: %v", err)
-	}
+	mcpServerPath := testharness.RepoPath("test", "harness", "test-mcp-server.mjs")
 
 	mcpServerDir := filepath.Dir(mcpServerPath)
 	mcpServers := make(map[string]copilot.MCPServerConfig, len(serverNames))

go/internal/e2e/pre_mcp_tool_call_hook_e2e_test.go

@@ -15,7 +15,7 @@ func TestPreMCPToolCallHookE2E(t *testing.T) {
 	client := ctx.NewClient()
 	t.Cleanup(func() { client.ForceStop() })
 
-	testHarnessDir, _ := filepath.Abs("../../../test/harness")
+	testHarnessDir := testharness.RepoPath("test", "harness")
 	metaEchoServer := filepath.Join(testHarnessDir, "test-mcp-meta-echo-server.mjs")
 
 	metaEchoConfig := func() map[string]copilot.MCPServerConfig {

go/internal/e2e/rpc_workspace_checkpoints_e2e_test.go

@@ -33,6 +33,11 @@ func TestRPCWorkspaceCheckpointsE2E(t *testing.T) {
 	})
 
 	t.Run("should return nil or empty content for unknown checkpoint", func(t *testing.T) {
+		// In-process, session.workspaces.readCheckpoint is answered by the native
+		// runtime, which decodes the checkpoint number as a u32 and rejects the
+		// large sentinel this test uses. Covered by the default (stdio) transport.
+		// Mirrors Rust's should_return_null_or_empty_content_for_unknown_checkpoint.
+		testharness.SkipIfInProcess(t, "readCheckpoint decodes the id as u32 in-process")
 		session := createWorkspaceRPCSession(t, client)
 		defer session.Disconnect()
 

go/internal/e2e/testharness/context.go

@@ -33,13 +33,11 @@ func CLIPath() string {
 		// 1.0.64-1 the @github/copilot package is a thin loader; the runnable
 		// index.js ships in the installed platform package
 		// (e.g. @github/copilot-linux-x64).
-		base, err := filepath.Abs("../../../nodejs/node_modules/@github")
-		if err == nil {
-			matches, _ := filepath.Glob(filepath.Join(base, "copilot-*", "index.js"))
-			if len(matches) > 0 {
-				cliPath = matches[0]
-				return
-			}
+		base := RepoPath("nodejs", "node_modules", "@github")
+		matches, _ := filepath.Glob(filepath.Join(base, "copilot-*", "index.js"))
+		if len(matches) > 0 {
+			cliPath = matches[0]
+			return
 		}
 	})
 	return cliPath

go/internal/e2e/testharness/helper.go

@@ -3,11 +3,32 @@ package testharness
 import (
 	"context"
 	"errors"
+	"path/filepath"
+	"runtime"
 	"time"
 
 	copilot "github.com/github/copilot-sdk/go"
 )
 
+// RepoPath resolves a path relative to the repository root, anchored to this
+// source file's directory rather than the process working directory. The
+// in-process (FFI) transport os.Chdir's the whole test process into a per-test
+// temp workdir (the shared runtime host inherits the process cwd), so any
+// cwd-relative resolution (e.g. filepath.Abs("../../../test/...")) would break
+// for every test after the first in-process one. This helper stays correct
+// regardless of the current working directory.
+func RepoPath(elem ...string) string {
+	_, callerFile, _, ok := runtime.Caller(0)
+	if !ok {
+		// Fall back to a cwd-relative join; only correct before any chdir.
+		return filepath.Join(append([]string{"..", "..", ".."}, elem...)...)
+	}
+	// This file lives at go/internal/e2e/testharness/, so the repo root is four
+	// levels up from its directory.
+	repoRoot := filepath.Join(filepath.Dir(callerFile), "..", "..", "..", "..")
+	return filepath.Join(append([]string{repoRoot}, elem...)...)
+}
+
 // GetFinalAssistantMessage waits for and returns the final assistant message from a session turn.
 // If alreadyIdle is true, skip waiting for session.idle (useful for resumed sessions where the
 // idle event was ephemeral and not persisted in the event history).

go/internal/e2e/testharness/proxy.go

@@ -38,8 +38,11 @@ func (p *CapiProxy) Start() (string, error) {
 		return p.proxyURL, nil
 	}
 
-	// The harness server is in the shared test directory
-	serverPath := "../../../test/harness/server.ts"
+	// The harness server is in the shared test directory. Anchor the path to
+	// the repo root (not the process cwd), because the in-process (FFI)
+	// transport os.Chdir's into a per-test temp workdir, which would otherwise
+	// break the cwd-relative resolution.
+	serverPath := RepoPath("test", "harness", "server.ts")
 
 	p.cmd = exec.Command("npx", "tsx", serverPath)
 	p.cmd.Dir = "." // Will be resolved relative to test execution

go/internal/ffihost/ffihost.go

@@ -53,6 +53,7 @@ const symbolPrefix = "copilot_runtime_"
 
 // ffiLibrary binds the copilot_runtime_* C ABI exports of a loaded cdylib.
 type ffiLibrary struct {
+	handle          uintptr
 	hostStart       func(argv unsafe.Pointer, argvLen uintptr, env unsafe.Pointer, envLen uintptr) uint32
 	hostShutdown    func(serverID uint32) bool
 	connectionOpen  func(serverID uint32, cb uintptr, userData uintptr, a unsafe.Pointer, aLen uintptr, b unsafe.Pointer, bLen uintptr, c unsafe.Pointer, cLen uintptr) uint32
@@ -95,7 +96,7 @@ func loadLibrary(libraryPath string) (lib *ffiLibrary, err error) {
 		}
 	}()
 
-	bound := &ffiLibrary{}
+	bound := &ffiLibrary{handle: handle}
 	purego.RegisterLibFunc(&bound.hostStart, handle, symbolPrefix+"host_start")
 	purego.RegisterLibFunc(&bound.hostShutdown, handle, symbolPrefix+"host_shutdown")
 	purego.RegisterLibFunc(&bound.connectionOpen, handle, symbolPrefix+"connection_open")
@@ -119,22 +120,24 @@ type Host struct {
 	extraArgs     []string
 	lib           *ffiLibrary
 
+	// mu guards disposed, activeCallbacks, serverID, and connectionID. A single
+	// mutex is used so that publishing disposed=true and draining in-flight
+	// callbacks are serialized against onOutbound's disposed-check/increment;
+	// this prevents a callback from feeding the receive buffer after it is
+	// closed (and avoids a data race on disposed observed by the -race detector).
+	mu           sync.Mutex
 	serverID     uint32
 	connectionID uint32
+	disposed     bool
+	// activeCallbacks counts outbound native callbacks currently executing.
+	activeCallbacks int
 
 	recv *receiveBuffer
 
-	disposeMu sync.Mutex
-	disposed  bool
-
 	// callbackHandle is the purego callback trampoline address. purego keeps the
 	// underlying Go closure alive for the process lifetime, so it (and this Host,
 	// which the closure captures) must not be relied upon to be freed.
 	callbackHandle uintptr
-	// Serializes teardown against in-flight native callbacks so the receive
-	// buffer is not fed after it is closed.
-	callbackMu      sync.Mutex
-	activeCallbacks int
 }
 
 // Create resolves the cdylib next to the CLI entrypoint and prepares the host.
@@ -182,12 +185,14 @@ func (h *Host) Start() error {
 	}
 
 	// host_start spawned the worker child via libuv's uv_spawn, which installs a
-	// SIGCHLD handler without SA_ONSTACK on its first call. On macOS the Go runtime
-	// aborts ("non-Go code set up signal handler without SA_ONSTACK flag") when it
-	// later reaps one of its own os/exec children, so re-add SA_ONSTACK to that
-	// foreign handler now that it exists (no-op off Darwin, and before the first
-	// spawn there is nothing to fix — hence here rather than at library load).
-	rearmForeignSignalHandlers()
+	// SIGCHLD handler without SA_ONSTACK on its first call. The Go runtime aborts
+	// ("non-Go code set up signal handler without SA_ONSTACK flag") when it later
+	// reaps one of its own os/exec children (e.g. a test-spawned MCP server) and
+	// the delivered SIGCHLD lands on a non-signal stack. Re-add SA_ONSTACK to that
+	// foreign handler now that it exists (implemented on darwin+linux; a no-op on
+	// other platforms, and before the first spawn there is nothing to fix — hence
+	// here rather than at library load).
+	rearmForeignSignalHandlers(h.lib.handle)
 
 	h.callbackHandle = purego.NewCallback(h.onOutbound)
 	h.connectionID = h.lib.connectionOpen(h.serverID, h.callbackHandle, 0, nil, 0, nil, 0, nil, 0)
@@ -233,18 +238,18 @@ func (h *Host) buildEnv() []byte {
 // are copied out before returning. Nothing may panic across the FFI boundary.
 func (h *Host) onOutbound(userData uintptr, bytesPtr uintptr, bytesLen uintptr) uintptr {
 	_ = userData
-	h.callbackMu.Lock()
+	h.mu.Lock()
 	if h.disposed {
-		h.callbackMu.Unlock()
+		h.mu.Unlock()
 		return 0
 	}
 	h.activeCallbacks++
-	h.callbackMu.Unlock()
+	h.mu.Unlock()
 
 	defer func() {
-		h.callbackMu.Lock()
+		h.mu.Lock()
 		h.activeCallbacks--
-		h.callbackMu.Unlock()
+		h.mu.Unlock()
 		// Never let a panic unwind into native code.
 		_ = recover()
 	}()
@@ -263,10 +268,10 @@ func (h *Host) onOutbound(userData uintptr, bytesPtr uintptr, bytesLen uintptr)
 }
 
 func (h *Host) writeFrame(frame []byte) (int, error) {
-	h.disposeMu.Lock()
+	h.mu.Lock()
 	closed := h.disposed || h.connectionID == 0
 	connID := h.connectionID
-	h.disposeMu.Unlock()
+	h.mu.Unlock()
 	if closed {
 		return 0, fmt.Errorf("the in-process runtime connection is closed")
 	}
@@ -285,27 +290,30 @@ func (h *Host) writeFrame(frame []byte) (int, error) {
 // resources. It is idempotent and waits for any in-flight outbound callback to
 // finish before closing the receive buffer.
 func (h *Host) Dispose() {
-	h.disposeMu.Lock()
+	h.mu.Lock()
 	if h.disposed {
-		h.disposeMu.Unlock()
+		h.mu.Unlock()
 		return
 	}
+	// Publish disposed under the same lock onOutbound uses to check it, so no new
+	// callback can pass the check and increment activeCallbacks after the drain
+	// loop below observes zero.
 	h.disposed = true
 	connID := h.connectionID
 	serverID := h.serverID
 	h.connectionID = 0
 	h.serverID = 0
-	h.disposeMu.Unlock()
+	h.mu.Unlock()
 
 	// Stop accepting new callbacks and wait for in-flight ones to drain before
 	// closing the receive buffer they feed.
 	for {
-		h.callbackMu.Lock()
+		h.mu.Lock()
 		if h.activeCallbacks == 0 {
-			h.callbackMu.Unlock()
+			h.mu.Unlock()
 			break
 		}
-		h.callbackMu.Unlock()
+		h.mu.Unlock()
 		runtime.Gosched()
 	}
 

go/internal/ffihost/sigonstack_darwin.go

@@ -31,15 +31,15 @@ const (
 // without SA_ONSTACK flag" when such a signal (notably SIGCHLD, signal 20 on
 // Darwin) is delivered while a Go-managed child process is reaped. libuv
 // installs a SIGCHLD handler without SA_ONSTACK, which poisons every subsequent
-// os/exec child reaped by Go in the same process (only observed on macOS; Linux
-// does not enforce this).
+// os/exec child reaped by Go in the same process (enforced by the Go runtime on
+// both macOS and Linux; the Linux variant lives in sigonstack_linux.go).
 //
 // We preserve each foreign handler and merely OR in SA_ONSTACK, so libuv's child
 // watching keeps working while the Go runtime stays happy. Handlers left at
 // SIG_DFL/SIG_IGN and Go's own handlers (which already carry SA_ONSTACK) are
 // untouched. Best-effort: any failure is silently ignored, since the worst case
 // is the pre-existing crash.
-func rearmForeignSignalHandlers() {
+func rearmForeignSignalHandlers(_ uintptr) {
 	handle, err := purego.Dlopen("/usr/lib/libSystem.B.dylib", purego.RTLD_NOW|purego.RTLD_GLOBAL)
 	if err != nil || handle == 0 {
 		return