diff options
Diffstat (limited to 'scripts/Run-Final-ElevatedVerification.ps1')
| -rw-r--r-- | scripts/Run-Final-ElevatedVerification.ps1 | 31 |
1 files changed, 28 insertions, 3 deletions
diff --git a/scripts/Run-Final-ElevatedVerification.ps1 b/scripts/Run-Final-ElevatedVerification.ps1 index 71135c2..1162da0 100644 --- a/scripts/Run-Final-ElevatedVerification.ps1 +++ b/scripts/Run-Final-ElevatedVerification.ps1 @@ -1,5 +1,8 @@ param( - [string]$EvidenceRoot = 'artifacts\evidence\final-elevated' + [string]$EvidenceRoot = 'artifacts\evidence\final-elevated', + [string]$TestRoot = 'C:\tmp', + [string]$VenvPython = 'C:\tmp\.venv\Scripts\python.exe', + [switch]$WindowsSecurityChild ) $ErrorActionPreference = 'Continue' @@ -23,7 +26,6 @@ $administrator = ([Security.Principal.WindowsPrincipal][Security.Principal.Windo "os=$([Environment]::OSVersion.VersionString)" "dotnet=$(& dotnet --version)" ) | Set-Content -LiteralPath $metadata -Encoding utf8NoBOM -if (-not $administrator) { throw 'Final elevated verification must run as Windows Administrator.' } function Invoke-VerificationStep { param([string]$Name, [scriptblock]$Action) @@ -47,10 +49,33 @@ $windowsTests = Join-Path $repository 'build\Release\Agent.Windows.Tests\net10.0 $coreTests = Join-Path $repository 'build\Release\Agent.Core.Tests\net10.0-windows10.0.26100.0\Agent.Core.Tests.exe' $plannerTests = Join-Path $repository 'build\Release\Agent.Planner.Tests\net10.0\Agent.Planner.Tests.exe' +if ($WindowsSecurityChild) { + if (-not $administrator) { Write-Error 'Windows Security child did not receive an administrator token.'; exit 2 } + $env:AGENT_MCP_MONKEY_ROOT = (Resolve-Path -LiteralPath $TestRoot).Path + $env:AGENT_MCP_TEST_VENV_PYTHON = (Resolve-Path -LiteralPath $VenvPython).Path + $env:AGENT_MCP_TEST_POWERSHELL = (Get-Command pwsh.exe -ErrorAction Stop).Source + $env:AGENT_MCP_TEST_POWERSHELL_RUNTIME = Split-Path $env:AGENT_MCP_TEST_POWERSHELL + $env:AGENT_MCP_TEST_CMD = $env:ComSpec + $childLog = Join-Path $evidence 'windows-security-tests-elevated.log' + # The suite intentionally shares one fixed Application Profile and global loopback state. + # Serialize it so crash/recovery cases cannot race another WFP/loopback case. + & $windowsTests -parallel none -failSkips *>&1 | Tee-Object -FilePath $childLog + exit $LASTEXITCODE +} +if ($administrator) { + throw 'Run the final verification orchestrator with a standard-user token. It elevates only the Windows Security test child.' +} + Invoke-VerificationStep 'bundle-show' { & (Join-Path $bundle 'agent-mcp.exe') show (Join-Path $bundle 'agent.yaml') } -Invoke-VerificationStep 'windows-security-tests' { & $windowsTests } +Invoke-VerificationStep 'windows-security-tests' { + $pwsh = (Get-Command pwsh.exe -ErrorAction Stop).Source + $child = Start-Process -FilePath $pwsh -Verb RunAs -WindowStyle Hidden -PassThru -Wait -ArgumentList @( + '-NoProfile', '-File', $PSCommandPath, '-EvidenceRoot', $EvidenceRoot, + '-TestRoot', $TestRoot, '-VenvPython', $VenvPython, '-WindowsSecurityChild') + if ($child.ExitCode -ne 0) { throw "Elevated Windows Security test child failed with exit code $($child.ExitCode)." } +} Invoke-VerificationStep 'core-unit-integration-tests' { & $coreTests } Invoke-VerificationStep 'planner-unit-tests' { & $plannerTests } Invoke-VerificationStep 'e2e-01-stdio' { |