From 39cd70caf53f929ae8fd2f521e73252d095bc70a Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 5 Feb 2026 00:34:43 -0800
Subject: [PATCH] fix: stabilize windows acl tests and command auth registry
 (#9335) (thanks @M00N7682)

---
 CHANGELOG.md                           |  1 +
 src/auto-reply/command-control.test.ts | 15 ++++++++++++---
 src/security/windows-acl.test.ts       | 22 +++++++++++++++-------
 3 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 95d0c64800..0d2a25c5a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Tests: stabilize Windows ACL coverage with deterministic os.userInfo mocking. (#9335) Thanks @M00N7682.
 - Heartbeat: allow explicit accountId routing for multi-account channels. (#8702) Thanks @lsh411.
 - TUI/Gateway: handle non-streaming finals, refresh history for non-local chat runs, and avoid event gap warnings for targeted tool streams. (#8432) Thanks @gumadeiras.
 - Shell completion: auto-detect and migrate slow dynamic patterns to cached files for faster terminal startup; add completion health checks to doctor/update/onboard.
diff --git a/src/auto-reply/command-control.test.ts b/src/auto-reply/command-control.test.ts
index b2fcc3d51d..01ad46bde1 100644
--- a/src/auto-reply/command-control.test.ts
+++ b/src/auto-reply/command-control.test.ts
@@ -2,19 +2,28 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import type { OpenClawConfig } from "../config/config.js";
 import type { MsgContext } from "./templating.js";
 import { setActivePluginRegistry } from "../plugins/runtime.js";
-import { createTestRegistry } from "../test-utils/channel-plugins.js";
+import { createOutboundTestPlugin, createTestRegistry } from "../test-utils/channel-plugins.js";
 import { resolveCommandAuthorization } from "./command-auth.js";
 import { hasControlCommand, hasInlineCommandTokens } from "./command-detection.js";
 import { listChatCommands } from "./commands-registry.js";
 import { parseActivationCommand } from "./group-activation.js";
 import { parseSendPolicyCommand } from "./send-policy.js";
 
+const createRegistry = () =>
+  createTestRegistry([
+    {
+      pluginId: "discord",
+      plugin: createOutboundTestPlugin({ id: "discord", outbound: { deliveryMode: "direct" } }),
+      source: "test",
+    },
+  ]);
+
 beforeEach(() => {
-  setActivePluginRegistry(createTestRegistry([]));
+  setActivePluginRegistry(createRegistry());
 });
 
 afterEach(() => {
-  setActivePluginRegistry(createTestRegistry([]));
+  setActivePluginRegistry(createRegistry());
 });
 
 describe("resolveCommandAuthorization", () => {
diff --git a/src/security/windows-acl.test.ts b/src/security/windows-acl.test.ts
index cf9c3d919b..e5c91f7999 100644
--- a/src/security/windows-acl.test.ts
+++ b/src/security/windows-acl.test.ts
@@ -1,5 +1,14 @@
 import { describe, expect, it, vi } from "vitest";
-import {
+import type { WindowsAclEntry, WindowsAclSummary } from "./windows-acl.js";
+
+const MOCK_USERNAME = "MockUser";
+
+vi.mock("node:os", () => ({
+  default: { userInfo: () => ({ username: MOCK_USERNAME }) },
+  userInfo: () => ({ username: MOCK_USERNAME }),
+}));
+
+const {
   createIcaclsResetCommand,
   formatIcaclsResetCommand,
   formatWindowsAclSummary,
@@ -7,9 +16,7 @@ import {
   parseIcaclsOutput,
   resolveWindowsUserPrincipal,
   summarizeWindowsAcl,
-  type WindowsAclEntry,
-  type WindowsAclSummary,
-} from "./windows-acl.js";
+} = await import("./windows-acl.js");
 
 describe("windows-acl", () => {
   describe("resolveWindowsUserPrincipal", () => {
@@ -33,7 +40,7 @@ describe("windows-acl", () => {
       const env = { USERNAME: "", USERDOMAIN: "WORKGROUP" };
       const result = resolveWindowsUserPrincipal(env);
       // Should return a username (from os.userInfo fallback) with WORKGROUP domain
-      expect(result).toContain("WORKGROUP\\");
+      expect(result).toBe(`WORKGROUP\\${MOCK_USERNAME}`);
     });
   });
 
@@ -303,8 +310,8 @@ Successfully processed 1 files`;
       // When env is empty, resolveWindowsUserPrincipal falls back to os.userInfo().username
       const result = formatIcaclsResetCommand("C:\\test\\file.txt", { isDir: false, env: {} });
       // Should contain the actual system username from os.userInfo
-      expect(result).toContain(":F");
-      expect(result).toContain("/grant:r");
+      expect(result).toContain(`"${MOCK_USERNAME}:F"`);
+      expect(result).not.toContain("%USERNAME%");
     });
   });
 
@@ -324,6 +331,7 @@ Successfully processed 1 files`;
       // Should return a valid command using the system username
       expect(result).not.toBeNull();
       expect(result?.command).toBe("icacls");
+      expect(result?.args).toContain(`${MOCK_USERNAME}:F`);
     });
 
     it("includes display string matching formatIcaclsResetCommand", () => {