fix: stabilize windows acl tests and command auth registry (#9335) (thanks @M00N7682)

CHANGELOG.md

@@ -24,6 +24,7 @@ Docs: https://docs.openclaw.ai
 ### Fixes
 
 - CLI: resolve bundled Chrome extension assets by walking up to the nearest assets directory; add resolver and clipboard tests. (#8914) Thanks @kelvinCB.
+- Tests: stabilize Windows ACL coverage with deterministic os.userInfo mocking. (#9335) Thanks @M00N7682.
 - Heartbeat: allow explicit accountId routing for multi-account channels. (#8702) Thanks @lsh411.
 - TUI/Gateway: handle non-streaming finals, refresh history for non-local chat runs, and avoid event gap warnings for targeted tool streams. (#8432) Thanks @gumadeiras.
 - Shell completion: auto-detect and migrate slow dynamic patterns to cached files for faster terminal startup; add completion health checks to doctor/update/onboard.

src/auto-reply/command-control.test.ts

@@ -2,19 +2,28 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import type { OpenClawConfig } from "../config/config.js";
 import type { MsgContext } from "./templating.js";
 import { setActivePluginRegistry } from "../plugins/runtime.js";
-import { createTestRegistry } from "../test-utils/channel-plugins.js";
+import { createOutboundTestPlugin, createTestRegistry } from "../test-utils/channel-plugins.js";
 import { resolveCommandAuthorization } from "./command-auth.js";
 import { hasControlCommand, hasInlineCommandTokens } from "./command-detection.js";
 import { listChatCommands } from "./commands-registry.js";
 import { parseActivationCommand } from "./group-activation.js";
 import { parseSendPolicyCommand } from "./send-policy.js";
 
+const createRegistry = () =>
+  createTestRegistry([
+    {
+      pluginId: "discord",
+      plugin: createOutboundTestPlugin({ id: "discord", outbound: { deliveryMode: "direct" } }),
+      source: "test",
+    },
+  ]);
+
 beforeEach(() => {
-  setActivePluginRegistry(createTestRegistry([]));
+  setActivePluginRegistry(createRegistry());
 });
 
 afterEach(() => {
-  setActivePluginRegistry(createTestRegistry([]));
+  setActivePluginRegistry(createRegistry());
 });
 
 describe("resolveCommandAuthorization", () => {

src/security/windows-acl.test.ts

@@ -1,5 +1,14 @@
 import { describe, expect, it, vi } from "vitest";
-import {
+import type { WindowsAclEntry, WindowsAclSummary } from "./windows-acl.js";
+
+const MOCK_USERNAME = "MockUser";
+
+vi.mock("node:os", () => ({
+  default: { userInfo: () => ({ username: MOCK_USERNAME }) },
+  userInfo: () => ({ username: MOCK_USERNAME }),
+}));
+
+const {
   createIcaclsResetCommand,
   formatIcaclsResetCommand,
   formatWindowsAclSummary,
@@ -7,9 +16,7 @@ import {
   parseIcaclsOutput,
   resolveWindowsUserPrincipal,
   summarizeWindowsAcl,
-  type WindowsAclEntry,
+} = await import("./windows-acl.js");
-  type WindowsAclSummary,
-} from "./windows-acl.js";
 
 describe("windows-acl", () => {
   describe("resolveWindowsUserPrincipal", () => {
@@ -33,7 +40,7 @@ describe("windows-acl", () => {
       const env = { USERNAME: "", USERDOMAIN: "WORKGROUP" };
       const result = resolveWindowsUserPrincipal(env);
       // Should return a username (from os.userInfo fallback) with WORKGROUP domain
-      expect(result).toContain("WORKGROUP\\");
+      expect(result).toBe(`WORKGROUP\\${MOCK_USERNAME}`);
     });
   });
 
@@ -303,8 +310,8 @@ Successfully processed 1 files`;
       // When env is empty, resolveWindowsUserPrincipal falls back to os.userInfo().username
       const result = formatIcaclsResetCommand("C:\\test\\file.txt", { isDir: false, env: {} });
       // Should contain the actual system username from os.userInfo
-      expect(result).toContain(":F");
+      expect(result).toContain(`"${MOCK_USERNAME}:F"`);
-      expect(result).toContain("/grant:r");
+      expect(result).not.toContain("%USERNAME%");
     });
   });
 
@@ -324,6 +331,7 @@ Successfully processed 1 files`;
       // Should return a valid command using the system username
       expect(result).not.toBeNull();
       expect(result?.command).toBe("icacls");
+      expect(result?.args).toContain(`${MOCK_USERNAME}:F`);
     });
 
     it("includes display string matching formatIcaclsResetCommand", () => {