test(windows): diagnose Console catalog ACL omission

[mohanagy]

Refs #214

This PR is diagnostic-only. Its Windows test intercepts the exact ConsoleDashboardApplicationService catalog call, delegates immediately to the real catalog implementation, and calls the real production ACL verifier. It records only fixed fixture labels and the bounded outcome trusted, untrusted, or error; verifier errors are rethrown so the catalog preserves its normal fail-closed behavior.

The resulting assertion distinguishes missing enumeration, repeated ACL verification failure, verifier error, and a later trusted-read or metadata omission. No timeout, security boundary, or production behavior has changed.

Local validation:

• npm test -- tests/console-dashboard-application-service.test.ts
• npm run lint
• npm run typecheck

Summary by CodeRabbit

• New Features

  • Added optional diagnostic callbacks for tracking configuration discovery stages and outcomes.
  • Exposed stable event types for monitoring candidate validation, parsing, deduplication, and acceptance.

• Tests

  • Expanded coverage for Windows permission checks and standard configuration discovery.
  • Added verification of candidate processing order, outcomes, and accepted configurations.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 49 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e7c9a1ca-7084-4fc5-83f0-eed4665e84cc

📥 Commits

Reviewing files that changed from the base of the PR and between 9f3caca and ea84cf9.

📒 Files selected for processing (2)

• src/console/console-config-catalog.ts
• tests/console-dashboard-application-service.test.ts

📝 Walkthrough

Walkthrough

Console configuration discovery now exposes optional candidate-stage diagnostics. Trusted-candidate reads report detailed outcomes across ACL, file, validation, parsing, and migration stages, while dashboard tests capture and verify ordered diagnostics and Windows ACL behavior.

Changes

Console catalog candidate diagnostics

Layer / File(s)	Summary
Observer contract and trusted-candidate pipeline src/console/console-config-catalog.ts	Adds exported candidate-stage types and reports outcomes throughout trusted configuration reading and handle closure.
Discovery-loop instrumentation src/console/console-config-catalog.ts	Reports candidate indexes, deduplication, metadata, acceptance, and unexpected failures during catalog discovery.
Instrumented discovery assertions tests/console-dashboard-application-service.test.ts	Injects ACL and stage observers, normalizes events, and asserts ordered discovery outcomes for standard configurations.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

• ci: diagnose intermittent Windows ACL descriptor probe timeout #214 — Adds candidate-stage instrumentation and Windows ACL assertions for the behavior discussed by the issue.

Possibly related PRs

• mohanagy/miftah#206 — Covers the same trusted standard-configuration discovery and validation flow.

Poem

A rabbit watched each candidate hop,
Through ACL gates and parse-time stop.
Stage by stage, the notes were spun,
Until trusted configs safely won.
“Good tests!” cried Bun, with carrots bright.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately reflects the diagnostic Windows ACL test change.
Description check	✅ Passed	It covers the diagnostic-only summary, security impact, and validation commands, though it doesn't follow the template headings exactly.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/214-windows-config-catalog

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/console/console-config-catalog.ts`:
- Around line 180-183: Extract a shared type alias for Awaited<ReturnType<typeof
open>> and use it in both closeTrustedConfigurationHandle and
readTrustedConfiguration, replacing the duplicated handle type expressions.
- Around line 180-192: Update closeTrustedConfigurationHandle so errors from
handle.close() are observed without being rethrown, allowing an already parsed
and validated candidate to remain accepted. Preserve the existing success and
error stage observations while preventing cleanup failure from rejecting the
successful candidate path.

In `@tests/console-dashboard-application-service.test.ts`:
- Around line 107-123: The catalogStageSummary helper implicitly maps candidate
names to candidateIndex values based on fixture file count and alphabetical
ordering. Add a brief comment near the candidates declaration or event filtering
documenting that gsc is index 0 and sentry is index 1 because the fixture files
are discovered in alphabetical order.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8356e31e-35be-4004-b40d-c5ddf2cf8975

📥 Commits

Reviewing files that changed from the base of the PR and between 2c11f2e and 9f3caca.

📒 Files selected for processing (2)

• src/console/console-config-catalog.ts
• tests/console-dashboard-application-service.test.ts