P2 slice 3: opening and closing the books (plan 3.9, D-21, D-23)

One wanderbooks executable. The books are open while the viewer, an
agent session or a terminal holds them: a host process takes leases on
a socket, starts the server (the hidden mode `wanderbooks server`) with
a pipe on its input, and closes it 10 s after the last lease ends. No
background service. One host even in a race (run/host.lock).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-cli/tests/one_executable.rs

@@ -103,6 +103,14 @@ fn each_mode_names_itself_in_its_usage() {
         "{err}"
     );
 
+    let out = wanderbooks().args(["server", "--help"]).output().unwrap();
+    assert!(out.status.success());
+    let err = String::from_utf8_lossy(&out.stderr);
+    assert!(
+        err.contains("usage: wanderbooks server [--root DIR]"),
+        "{err}"
+    );
+
     let out = wanderbooks().arg("--help").output().unwrap();
     let err = String::from_utf8_lossy(&out.stderr);
     for line in [
@@ -129,9 +137,9 @@ fn the_viewer_names_itself_in_its_usage() {
 #[test]
 fn a_mode_refuses_what_it_does_not_know() {
     let modes: &[&str] = if cfg!(feature = "gui") {
-        &["dev-stdio", "gui"]
+        &["dev-stdio", "gui", "server"]
     } else {
-        &["dev-stdio"]
+        &["dev-stdio", "server"]
     };
     for &mode in modes {
         let out = wanderbooks()
@@ -150,7 +158,7 @@ fn a_mode_refuses_what_it_does_not_know() {
 
 #[test]
 fn a_mode_comes_first() {
-    for mode in ["gui", "dev-stdio"] {
+    for mode in ["gui", "dev-stdio", "server"] {
         let out = wanderbooks().args(["--codex", mode]).output().unwrap();
         assert_eq!(out.status.code(), Some(2), "{mode}: {out:?}");
         let err = String::from_utf8_lossy(&out.stderr);
@@ -218,3 +226,65 @@ fn the_server_only_build_has_no_viewer() {
         "{err}"
     );
 }
+
+/// Books in the data root are the books server's alone (plan 3.1): the
+/// test server refuses them, and the books server needs a root.
+#[cfg(unix)]
+#[test]
+fn dev_stdio_refuses_books_in_the_private_folder() {
+    let home = tempfile::Builder::new()
+        .prefix("wb-one-root-")
+        .tempdir()
+        .unwrap();
+    let out = wanderbooks()
+        .args(["setup", "--home"])
+        .arg(home.path())
+        .env_remove("XDG_DATA_HOME")
+        .output()
+        .unwrap();
+    assert!(out.status.success(), "{out:?}");
+    let root = home.path().join(".local/share/wanderbooks");
+    for inside in [
+        root.join("books/acme"),
+        root.clone(),
+        root.join("books/a/b"),
+    ] {
+        let out = wanderbooks()
+            .args(["dev-stdio", "--data-dir"])
+            .arg(&inside)
+            .stdin(std::process::Stdio::null())
+            .output()
+            .unwrap();
+        assert_eq!(out.status.code(), Some(2), "{inside:?}: {out:?}");
+        let err = String::from_utf8_lossy(&out.stderr);
+        assert!(err.contains("only the books server opens"), "{err}");
+        assert!(!inside.join("journal.jsonl").exists(), "{inside:?}");
+    }
+    assert!(!root.join("books/acme").exists());
+    // A relative path, from inside the root.
+    let out = wanderbooks()
+        .args(["dev-stdio", "--data-dir", "acme"])
+        .current_dir(root.join("books"))
+        .stdin(std::process::Stdio::null())
+        .output()
+        .unwrap();
+    assert_eq!(out.status.code(), Some(2), "{out:?}");
+    assert!(!root.join("books/acme").exists());
+
+    // No root yet: the books server says to run setup.
+    let empty = tempfile::Builder::new()
+        .prefix("wb-one-noroot-")
+        .tempdir()
+        .unwrap();
+    let out = wanderbooks()
+        .args(["server", "--root"])
+        .arg(empty.path().join("none"))
+        .stdin(std::process::Stdio::null())
+        .output()
+        .unwrap();
+    assert_eq!(out.status.code(), Some(2), "{out:?}");
+    assert!(
+        String::from_utf8_lossy(&out.stderr).contains("run `wanderbooks setup` first"),
+        "{out:?}"
+    );
+}

crates/ledger-cli/tests/setup.rs

@@ -69,16 +69,20 @@ fn setup_makes_the_private_folder_and_never_names_it() {
 }
 
 #[test]
-fn a_root_elsewhere_is_noted_and_xdg_is_honoured() {
+fn a_root_elsewhere_is_noted_for_next_time() {
+    // (XDG_DATA_HOME is honoured only for this account's own home, which
+    // a test never touches: Root::setup's tests cover it.)
     let home = tempfile::Builder::new()
-        .prefix("wb-setup-xdg-")
+        .prefix("wb-setup-else-")
         .tempdir()
         .unwrap();
-    let xdg = home.path().join("xdg");
+    let elsewhere = home.path().join("elsewhere").join("wanderbooks");
     let out = wanderbooks()
         .args(["setup", "--home"])
         .arg(home.path())
-        .env("XDG_DATA_HOME", &xdg)
+        .arg("--root")
+        .arg(&elsewhere)
+        .env_remove("XDG_DATA_HOME")
         .output()
         .unwrap();
     assert!(out.status.success(), "{out:?}");
@@ -86,13 +90,10 @@ fn a_root_elsewhere_is_noted_and_xdg_is_honoured() {
         String::from_utf8_lossy(&out.stdout).contains("noted for next time"),
         "{out:?}"
     );
-    assert_eq!(mode(&xdg.join("wanderbooks")), 0o700);
+    assert_eq!(mode(&elsewhere), 0o700);
     let noted =
         std::fs::read_to_string(home.path().join(".local/share/wanderbooks.location")).unwrap();
-    assert_eq!(
-        noted.trim_end(),
-        xdg.join("wanderbooks").display().to_string()
-    );
+    assert_eq!(noted.trim_end(), elsewhere.display().to_string());
 }
 
 #[test]
@@ -122,3 +123,32 @@ fn setup_refuses_what_it_does_not_know_and_unsafe_folders() {
     let out = wanderbooks().args(["--force", "setup"]).output().unwrap();
     assert_eq!(out.status.code(), Some(2));
 }
+
+/// With another home given (tests), this account's XDG_DATA_HOME is never
+/// read: setup can't be aimed at this account's real books by it.
+#[test]
+fn another_home_ignores_this_accounts_data_home() {
+    let home = tempfile::Builder::new()
+        .prefix("wb-setup-xdg-")
+        .tempdir()
+        .unwrap();
+    let elsewhere = home.path().join("elsewhere");
+    std::fs::create_dir(&elsewhere).unwrap();
+    let out = wanderbooks()
+        .args(["setup", "--home"])
+        .arg(home.path())
+        .env("XDG_DATA_HOME", &elsewhere)
+        .output()
+        .unwrap();
+    assert!(out.status.success(), "{out:?}");
+    assert!(
+        home.path()
+            .join(".local/share/wanderbooks/.wanderbooks-root")
+            .is_file()
+    );
+    assert_eq!(
+        std::fs::read_dir(&elsewhere).unwrap().count(),
+        0,
+        "XDG_DATA_HOME was used"
+    );
+}