From 4df7e8e849f1a36d27d3215f664c54139e286c8b Mon Sep 17 00:00:00 2001
From: JUN <243035832+lidge-jun@users.noreply.github.com>
Date: Thu, 29 Oct 2026 00:39:51 +0900
Subject: [PATCH] test: stub the owner-ACL verifier in mocked config-root
 fixtures and canonicalize the history probe path

---
 .../claude-config-root-late-admission.test.ts                | 5 +++++
 .../claude-config-root-writer-barrier.test.ts                | 5 +++++
 tests/fixtures/stop-restore-history-runner.ts                | 3 ++-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/tests/claude-integration/claude-config-root-late-admission.test.ts b/tests/claude-integration/claude-config-root-late-admission.test.ts
index 2d0b603b05d..b226d1438d0 100644
--- a/tests/claude-integration/claude-config-root-late-admission.test.ts
+++ b/tests/claude-integration/claude-config-root-late-admission.test.ts
@@ -18,6 +18,7 @@ import { inspectDesktop3pConfigLibrary, writeDesktop3pConfig } from "../../src/c
 import { resolveDesktop3pConfigLibraryPath } from "../../src/claude/desktop-3p-library";
 import { resetHardenedStateForTests, setAsyncIcaclsBeltSchedulerForTests, setAsyncIcaclsRunnerForTests, setIcaclsRunnerForTests, setNowForTests, setPlatformForTests, windowsSecretAclReapPendingForPath, type IcaclsResult } from "../../src/lib/windows-secret-acl";
 import { setSyntheticWindowsPrincipalForTests } from "../../src/lib/windows-user-principal";
+import { setWindowsOwnerAclRunnerForTests } from "../../src/lib/windows-owner-acl";
 import { writeServiceApiTokenFile } from "../../src/lib/service-secrets";
 import type { OcxConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
@@ -52,6 +53,9 @@ beforeEach(() => {
   setPlatformForTests("win32");
   setSyntheticWindowsPrincipalForTests("*S-1-5-21-1-2-3-1001");
   setIcaclsRunnerForTests(() => success);
+  // icacls is mocked, so the real PowerShell owner check must not decide hardening:
+  // a cold probe can exhaust the 1s ACL budget and refuse before the mocked icacls runs.
+  setWindowsOwnerAclRunnerForTests(() => ({ success: false, timedOut: false, stdout: "" }));
 });
 afterEach(async () => {
   await paths.flushConfigDirHardeningAndReaps(root);
@@ -61,6 +65,7 @@ afterEach(async () => {
   setAsyncIcaclsBeltSchedulerForTests(null);
   setNowForTests(null);
   setIcaclsRunnerForTests(null);
+  setWindowsOwnerAclRunnerForTests(null);
   setLocalCaWindowsAclRunnerForTests(null);
   setPlatformForTests(null);
   setSyntheticWindowsPrincipalForTests(null);
diff --git a/tests/claude-integration/claude-config-root-writer-barrier.test.ts b/tests/claude-integration/claude-config-root-writer-barrier.test.ts
index 44e34ec2906..89b6ec9e87f 100644
--- a/tests/claude-integration/claude-config-root-writer-barrier.test.ts
+++ b/tests/claude-integration/claude-config-root-writer-barrier.test.ts
@@ -13,6 +13,7 @@ import { inspectDesktop3pConfigLibrary, removeDesktop3pStandardPivot, writeDeskt
 import { resolveDesktop3pConfigLibraryPath } from "../../src/claude/desktop-3p-library";
 import { resetHardenedStateForTests, setAsyncIcaclsBeltSchedulerForTests, setAsyncIcaclsRunnerForTests, setIcaclsRunnerForTests, setNowForTests, setPlatformForTests, windowsSecretAclReapPendingForPath, type IcaclsResult } from "../../src/lib/windows-secret-acl";
 import { setSyntheticWindowsPrincipalForTests } from "../../src/lib/windows-user-principal";
+import { setWindowsOwnerAclRunnerForTests } from "../../src/lib/windows-owner-acl";
 import { writeServiceApiTokenFile } from "../../src/lib/service-secrets";
 import type { OcxConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
@@ -44,6 +45,9 @@ beforeEach(() => {
   setPlatformForTests("win32");
   setSyntheticWindowsPrincipalForTests("*S-1-5-21-1-2-3-1001");
   setIcaclsRunnerForTests(() => success);
+  // icacls is mocked, so the real PowerShell owner check must not decide hardening:
+  // a cold probe can exhaust the 1s ACL budget and refuse before the mocked icacls runs.
+  setWindowsOwnerAclRunnerForTests(() => ({ success: false, timedOut: false, stdout: "" }));
 });
 afterEach(async () => {
   await paths.flushConfigDirHardeningAndReaps(root);
@@ -53,6 +57,7 @@ afterEach(async () => {
   setAsyncIcaclsBeltSchedulerForTests(null);
   setNowForTests(null);
   setIcaclsRunnerForTests(null);
+  setWindowsOwnerAclRunnerForTests(null);
   setLocalCaWindowsAclRunnerForTests(null);
   setPlatformForTests(null);
   setSyntheticWindowsPrincipalForTests(null);
diff --git a/tests/fixtures/stop-restore-history-runner.ts b/tests/fixtures/stop-restore-history-runner.ts
index 181fc2f20e2..7a18ac055f7 100644
--- a/tests/fixtures/stop-restore-history-runner.ts
+++ b/tests/fixtures/stop-restore-history-runner.ts
@@ -83,7 +83,8 @@ writeFileSync(backup, JSON.stringify({ version: 1, stateDbPath: canonicalDb, ent
 const lockChecks: { phase: string; config: boolean; history: boolean }[] = [];
 if (mode === "sync" && ownership === "standalone") {
   const identity = await import("../../src/codex/user-identity");
-  const historyLockPath = identity.resolveCodexHistorySerializationDatabasePath(identity.resolveEffectiveUserIdentity(), codex, canonicalDb);
+  // Production locks the canonical CODEX_HOME spelling; macOS temp aliases (/var vs /private/var) hash differently.
+  const historyLockPath = identity.resolveCodexHistorySerializationDatabasePath(identity.resolveEffectiveUserIdentity(), realpathSync.native(codex), canonicalDb);
   function held(path: string): boolean {
     const probe = new Database(path);
     try { probe.exec("PRAGMA busy_timeout = 0; BEGIN IMMEDIATE; ROLLBACK"); return false; }