lidge-jun · Oct 10, 2026 · Oct 9, 2026 · Oct 10, 2026 · Oct 10, 2026
@@ -6,6 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { claudeInterceptCaCertPath, claudeInterceptStateDir, ensureLocalInterceptCa } from "../../src/claude/intercept/local-ca";
 import { setLocalCaFileHooksForTests } from "../../src/claude/intercept/local-ca-files";
+import { hardenSecretDir } from "../../src/lib/windows-secret-acl";
 
 const roots: string[] = [];
 function fixture(): string {
@@ -87,6 +88,7 @@ test("local CA ignores predictable predecessor temp names and leaves external fi
   const root = fixture();
   const dir = claudeInterceptStateDir(root);
   mkdirSync(dir, { mode: 0o700 });
+  hardenSecretDir(dir, { required: true });
   const oldTemp = join(dir, `ca.key.${process.pid}.tmp`);
   writeFileSync(oldTemp, "reserved predecessor", { mode: 0o600 });
   const ca = ensureLocalInterceptCa(root);

@@ -13,12 +13,20 @@ function diagnosticPayload(): Record<string, unknown> {
   return JSON.parse(line.slice(prefix.length)) as Record<string, unknown>;
 }
 
+let savedDebug: string | undefined;
+let savedFramesDebug: string | undefined;
 beforeEach(() => {
+  savedDebug = process.env.OCX_DEBUG;
+  savedFramesDebug = process.env.OCX_DEBUG_FRAMES;
+  delete process.env.OCX_DEBUG;
+  delete process.env.OCX_DEBUG_FRAMES;
   resetDebugSettingsForTests();
   resetDebugLogBufferForTests();
 });
 
 afterEach(() => {
+  if (savedDebug === undefined) delete process.env.OCX_DEBUG; else process.env.OCX_DEBUG = savedDebug;
+  if (savedFramesDebug === undefined) delete process.env.OCX_DEBUG_FRAMES; else process.env.OCX_DEBUG_FRAMES = savedFramesDebug;
   resetDebugSettingsForTests();
   resetDebugLogBufferForTests();
 });

@@ -1,8 +1,8 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { spawn } from "node:child_process";
+import { execFileSync, spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { setTrustedWindowsElevationExecutablesForTests } from "../../src/lib/windows-elevation";
+import { resolveTrustedWindowsPowerShellExe, setTrustedWindowsElevationExecutablesForTests } from "../../src/lib/windows-elevation";
 import {
   createWindowsPowerShellFixture,
   probeWindowsPowerShellFixture,
@@ -956,40 +956,26 @@ describe("Windows Win32_Process owner enumeration (#476)", () => {
     () => {
       // Keep a live process whose CommandLine contains a Codex basename token.
       const child = spawn(
-        "powershell.exe",
+        resolveTrustedWindowsPowerShellExe(),
         [
           "-NoProfile", "-NoLogo", "-NonInteractive",
           "-Command",
-          "Start-Sleep -Seconds 45 # codex app-server integration-probe",
+          "Start-Sleep -Seconds 90 # codex app-server integration-probe",
         ],
         { stdio: "ignore", windowsHide: true },
       );
       try {
         expect(child.pid).toBeGreaterThan(1);
-        // Brief settle so Win32_Process can observe the child. A loaded Windows
-        // runner can also exhaust one CIM enumeration deadline, so tolerate one
-        // transient empty result OR one thrown deadline (ETIMEDOUT propagates by
-        // design) while keeping the production timeout unchanged.
-        Bun.sleepSync(250);
-        const enumerate = (): ReturnType<typeof listWindowsSnapshots> | undefined => {
-          try {
-            return listWindowsSnapshots();
-          } catch {
-            return undefined; // transient CIM deadline on a contended runner
-          }
-        };
-        let snapshots = enumerate() ?? [];
-        let match = snapshots.find(snapshot => snapshot.pid === child.pid);
-        if (!match) {
-          Bun.sleepSync(250);
-          snapshots = enumerate() ?? [];
-          match = snapshots.find(snapshot => snapshot.pid === child.pid);
-        }
-        if (!match) {
-          Bun.sleepSync(1_000);
-          snapshots = enumerate() ?? [];
-          match = snapshots.find(snapshot => snapshot.pid === child.pid);
-        }
+        // This verifies native enumeration, not the product's 8s latency bound.
+        // 46 same-user candidates took 28s in real GetOwner calls on a busy host.
+        // Keep the same trusted executable/script/parser with a bounded test runner;
+        // the fixture's explicit finally owns its lifetime, and lookup errors propagate.
+        const snapshots = listWindowsSnapshots(psCommand => execFileSync(
+          resolveTrustedWindowsPowerShellExe(),
+          ["-NoProfile", "-NoLogo", "-NonInteractive", "-Command", psCommand],
+          { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 45_000, windowsHide: true },
+        ));
+        const match = snapshots.find(snapshot => snapshot.pid === child.pid);
         expect(match).toBeDefined();
         expect(match!.owner).toMatch(/\\/);
         expect(match!.commandLine.toLowerCase()).toContain("codex app-server");
@@ -1002,7 +988,7 @@ describe("Windows Win32_Process owner enumeration (#476)", () => {
         }
       }
     },
-    { timeout: 35_000 },
+    { timeout: 60_000 },
   );
 });
 

@@ -365,7 +365,15 @@ model_provider = "anthropic"
 [model_providers.anthropic]
 name = "anthropic"
 `);
-    expect(collectProjectCodexConfigWarnings({ cwd: testDir, codexConfigPath })).toEqual([]);
+    const warnings = collectProjectCodexConfigWarnings({ cwd: testDir, codexConfigPath });
+    expect(warnings.filter(warning => warning.path === join(projectDir, ".codex", "config.toml"))).toEqual([]);
+    writeGlobalRoutingConfig(`
+[projects.'${escaped}\\proj']
+trust_level = "trusted"
+`);
+    expect(collectProjectCodexConfigWarnings({ cwd: testDir, codexConfigPath })
+      .filter(warning => warning.path === join(projectDir, ".codex", "config.toml"))
+      .map(warning => warning.code)).toEqual(["model_providers_table"]);
   });
 
   test("uncached collection reflects project config changes", () => {