Skip to content

test(claude): report the hardened local-CA ACL in the first-party apply suite #8016

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lidge-jun merged 2 commits into from
Oct 30, 2026
Merged

test(claude): report the hardened local-CA ACL in the first-party apply suite #8016

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4724015
test(claude): report the hardened local-CA ACL in the first-party app…
lidge-jun Oct 30, 2026
96eee6e
test(claude): read the cached SID inside the injected ACL runner and …
lidge-jun Oct 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion tests/claude-integration/claude-desktop-first-party.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ import { firstPartyDesired } from "../../src/claude/first-party-settings";
import type { OcxConfig } from "../../src/types";
import { removeTreeWithRetry } from "../helpers/remove-tree";
import { flushConfigDirHardeningAndReaps } from "../../src/config/paths";
import { setLocalCaWindowsAclRunnerForTests } from "../../src/claude/intercept/local-ca-windows";
import { resolveCurrentWindowsPrincipal } from "../../src/lib/windows-user-principal";

let root = "";
let lifecycleLock: ReturnType<typeof isolateClientLifecycleLock>;
Expand Down Expand Up @@ -72,10 +74,23 @@ beforeEach(() => {
process.env.OPENCODEX_CLAUDE_DESKTOP_CONFIG_DIR = library;
process.env.CLAUDE_CONFIG_DIR = claudeDir;
writeFileSync(join(root, "config.json"), JSON.stringify(config()));
// The local-CA ACL inspection spawns PowerShell under the shared 30 s principal-lookup budget,
// which a loaded hosted Windows runner can exhaust (local_ca_path_unsafe). This file tests
// first-party apply; claude-intercept-local-ca.test.ts runs the native inspection. Report the
// private ACL for the current SID, which production resolves (and caches) before this runner.
if (process.platform === "win32") {
setLocalCaWindowsAclRunnerForTests((_path, timeoutMs) => {
const sid = resolveCurrentWindowsPrincipal(timeoutMs).replace(/^\*/, "");
return { success: true, exitCode: 0, timedOut: false, stdout: JSON.stringify({
owner: sid, protected: true, rules: [{ sid, type: 0, rights: 2032127 }],
}) };
});
}
});

afterEach(async () => {
await flushConfigDirHardeningAndReaps(root);
try { await flushConfigDirHardeningAndReaps(root); }
finally { setLocalCaWindowsAclRunnerForTests(null); }
lifecycleLock.restore();
for (const key of ENV_KEYS) {
if (previous[key] === undefined) delete process.env[key];
Expand Down
Loading