| 417 | }); |
| 418 | fs.rmSync(optInProj, { recursive: true, force: true }); |
| 419 | assert( |
| 420 | result.status === 0, |
| 421 | `Expected exit code 0 (allow), got ${result.status}: ${result.stdout} ${result.stderr}` |
| 422 | ); |
| 423 | }); |
| 424 | |
| 425 | // ── 7. Native Memory Directory Allowlist ── |
| 426 | |
| 427 | console.log('\n▶ Native Memory Directory Allowlist'); |
| 428 | |
| 429 | test('protect-files allows native memory writes through an equivalent home alias', () => { |
| 430 | const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'citadel-home-')); |
| 431 | const tmpHome = path.join(tmpRoot, 'real-home'); |
| 432 | const homeAlias = path.join(tmpRoot, 'home-alias'); |
| 433 | fs.mkdirSync(tmpHome); |