Stabilize diagnostic export and preserve authorized policy continuity

tests/debug-collector-acl.test.mjs

@@ -0,0 +1,12 @@
+import test from 'node:test';import assert from 'node:assert/strict';
+import {mkdtempSync,rmSync} from 'node:fs';import {tmpdir} from 'node:os';import {join,resolve} from 'node:path';
+import {protectCollectorDirectory} from '../scripts/debug-collector-acl.mjs';
+
+test('ACL proof rejects process failures and unverified or malformed success without exposing errors',()=>{
+ for(const result of [{status:1,stdout:'{"verified":true,"changed":false}',stderr:'private path/account'},{status:0,stdout:'{"verified":false,"changed":false}'},{status:0,stdout:'{}'},{status:0,stdout:'private error'}])assert.throws(()=>protectCollectorDirectory('unused',{run:()=>result}),error=>error.message.startsWith('Collector directory protection')&&!error.message.includes('private'));
+});
+test('actual Windows exact private ACL is verified without being reapplied on restart',{skip:process.platform!=='win32'},t=>{
+ const directory=mkdtempSync(join(tmpdir(),'safetynet-collector-acl-'));t.after(()=>{assert.ok(resolve(directory).startsWith(resolve(tmpdir())));rmSync(directory,{recursive:true,force:true});});
+ const initial=protectCollectorDirectory(directory);assert.equal(initial.verified,true);
+ assert.deepEqual(protectCollectorDirectory(directory),{verified:true,changed:false});
+});