fix(speedtest,portal): CodeRabbit Majors from #525 + wins_ref skip

[axpnet]

Follow-up to #525 (merged as aabde69), closing the 2 Major and 1 portal Minor CodeRabbit findings.

Major: speedtest disconnect on cancel after connect

speedtest.rs: the cancel branch on scratch-dir creation returned without disconnecting, while connect() had already succeeded and every other post-connect error path disconnects. Now it disconnects before returning.
Pin: cancel_after_connect_disconnects_provider (structure pin, fails if the disconnect is removed).

Major: reject descendants of public web document roots

is_public_web_document_root only matched exact roots and trailing suffixes, so /var/www/html/uploads or /home/alice/public_html/bench passed validation while being web-servable. Now: prefix match on a path-component boundary for the known roots, plus per-segment match for public_html / htdocs / wwwroot / www. False friends like /var/www-data stay allowed.
Pin: extended public_web_document_roots_are_rejected with descendant cases and false friends.

Minor: portal wins_ref when case 1 failed

tests/portal-chooser/portal-chooser-test.sh: when the case 1 session fails its precondition, windows-after.txt is never written and count_lines read it as 0, turning a missing baseline into a chooser-shaped FAIL. Missing baseline is now a skip, same contract as the #521 cascade-stop.

Gates

• cargo test --lib speedtest:: 27/27
• cargo clippy --lib -- -D warnings clean, cargo fmt --check clean
• tests/portal-chooser/selftest-precondition.sh 6/6, selftest-portal.sh 14/14

The 14 i18n Minor findings from #525 are intentionally out of scope here (separate batch via the GLM method).

Summary by CodeRabbit

• Bug Fixes

  • Improved cancellation cleanup to prevent lingering provider sessions.
  • Strengthened protection against using public document-root directories while avoiding false positives for similarly named paths.
  • Improved portal chooser test validation when reference data is unavailable.

• Tests

  • Added coverage for nested document-root paths, lookalike directories, and cancellation cleanup behavior.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

Warning

Review limit reached

@axpnet, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 41ed258a-8b2b-4cfa-bc87-868947313c71

📥 Commits

Reviewing files that changed from the base of the PR and between 82df5ce and fe694ff.

📒 Files selected for processing (1)

• src-tauri/src/speedtest.rs

📝 Walkthrough

Walkthrough

The speedtest flow now disconnects providers after post-connect cancellation, and public document-root detection uses path-component boundaries with expanded tests. The portal chooser test now handles missing window-count baselines explicitly.

Changes

Speedtest safeguards

Layer / File(s)	Summary
Provider cleanup on cancellation src-tauri/src/speedtest.rs	The scratch-directory cancellation branch disconnects an already-connected provider before returning, with regression coverage for the cleanup call.
Document-root boundary validation src-tauri/src/speedtest.rs	Public roots are matched by full path boundaries, per-segment document-root names remain rejected, and tests cover descendants and lookalike paths.

Portal chooser assertion

Layer / File(s)	Summary
Baseline-aware window assertion tests/portal-chooser/portal-chooser-test.sh	The window-count comparison skips when its baseline is absent and reports matching or differing counts when the baseline exists.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• axpdev-lab/aeroftp#505: Introduces the portal chooser integration test harness covered by this assertion update.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to the changes, but it is noisy and uses unclear shorthand like "CodeRabbit Majors" and "wins_ref skip".	Rewrite it as a clear, concise sentence that names the main fixes, such as speedtest cancellation cleanup and portal baseline handling.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cr525-speedtest-portal

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src-tauri/src/speedtest.rs`:
- Around line 803-833: Normalize dot and dot-dot path components in
validate_remote_dir_for_speedtest before calling is_public_web_document_root,
matching the lexical resolution performed by join_remote_path. Ensure normalized
paths such as /tmp/../var/www/html and paths escaping from public_html are
classified by the existing PUBLIC_ROOTS and component checks, while preserving
the current root-boundary behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d0adf5b5-ee27-4bab-87dc-61453c261cdb

📥 Commits

Reviewing files that changed from the base of the PR and between c4680ab and 82df5ce.

📒 Files selected for processing (2)

• src-tauri/src/speedtest.rs
• tests/portal-chooser/portal-chooser-test.sh