diff --git a/test/support/connect-flow-test-harness.ts b/test/support/connect-flow-test-harness.ts
index 0cfbc3e33ac..bae208eaadb 100644
--- a/test/support/connect-flow-test-harness.ts
+++ b/test/support/connect-flow-test-harness.ts
@@ -7,6 +7,7 @@ import { createRequire } from "node:module";
 import { type MockInstance, vi } from "vitest";
 import type { ManagedGatewayControlCompletion } from "../../src/lib/actions/sandbox/gateway-restart";
 import type { SecretBoundaryRefusalReason } from "../../src/lib/actions/sandbox/hermes-secret-boundary-recovery";
+import type { WslDetectionOptions } from "../../src/lib/platform";
 import type { ConfigObject } from "../../src/lib/security/credential-filter";
 import type { SandboxEntry } from "../../src/lib/state/registry";
 
@@ -274,6 +275,15 @@ export function createConnectHarness(options: ConnectHarnessOptions = {}): Conne
   const probeOllamaAuthProxyHealthSpy = vi
     .spyOn(ollamaProxy, "probeOllamaAuthProxyHealth")
     .mockReturnValue({ ok: true });
+  const realIsWsl = platform.isWsl as (opts?: WslDetectionOptions) => boolean;
+  // Pin the platform gate for every isWsl consumer the harness loads: isWsl
+  // answers false off Linux before it reads WSL_DISTRO_NAME, so a case that
+  // stubs that variable cannot reach the WSL route on a macOS contributor
+  // machine. With the gate pinned, the stubbed environment decides, on every
+  // host, and a caller's own options still win over the pin (#8868).
+  vi.spyOn(platform, "isWsl").mockImplementation((...args: unknown[]) =>
+    realIsWsl({ platform: "linux", ...((args[0] as WslDetectionOptions | undefined) ?? {}) }),
+  );
   const primaryRegistryEntry: SandboxEntry = {
     name: "alpha",
     agent: options.agentName ?? "openclaw",