mirror of
https://github.com/morluto/rea
synced 2026-10-28 15:07:26 -04:00
5f94077b3c
Use the pre-launch baseline only to select candidates for current native identity/token validation. Preserve confirmed absence and verified foreign generations instead of carrying a premature baseline identity failure. Exercise the real Linux enumeration/exit race and retain countercontrols for unknown identities and live token-owned processes. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
51 lines
1.7 KiB
TypeScript
51 lines
1.7 KiB
TypeScript
import { randomUUID } from "node:crypto";
|
|
|
|
import { expect, it } from "vitest";
|
|
|
|
import { verifyNoTokenOwnedProcesses } from "../../../src/process/ProcessOwnership.js";
|
|
import { createSystemProcessOwnershipHost } from "../../../src/process/ProcessOwnershipObservation.js";
|
|
import {
|
|
spawnProviderProcessFixture,
|
|
stopProviderProcessFixture,
|
|
waitForProviderProcessReady,
|
|
} from "../../fixtures/providerProcess.js";
|
|
|
|
it.skipIf(process.platform !== "linux")(
|
|
"accepts native absence after a baseline process exits between table and identity reads",
|
|
async () => {
|
|
const child = spawnProviderProcessFixture("graceful");
|
|
const native = createSystemProcessOwnershipHost("linux", process.env);
|
|
try {
|
|
await waitForProviderProcessReady(child);
|
|
const baseline = await native.captureBaseline?.();
|
|
expect(baseline).toContainEqual({
|
|
pid: child.pid,
|
|
identity: expect.stringMatching(/^linux-starttime:\d+$/u),
|
|
});
|
|
const rows = (await native.listProcesses()).filter(
|
|
({ pid }) => pid === child.pid,
|
|
);
|
|
expect(rows).toHaveLength(1);
|
|
|
|
await expect(
|
|
verifyNoTokenOwnedProcesses(
|
|
randomUUID(),
|
|
{
|
|
...native,
|
|
listProcesses: async () => {
|
|
// Keep one real candidate row, then force the enumeration race
|
|
// before the unmodified native identity/token observer runs.
|
|
await stopProviderProcessFixture(child);
|
|
return rows;
|
|
},
|
|
},
|
|
baseline,
|
|
),
|
|
).resolves.toEqual({ cleaned: true, signaled: false });
|
|
} finally {
|
|
await stopProviderProcessFixture(child);
|
|
await native.close?.();
|
|
}
|
|
},
|
|
);
|