Validate packet capture outcomes and narrow cleanup inventory

tests/Run-All.ps1

@@ -8,5 +8,5 @@ foreach ($file in $files) {
     [System.Management.Automation.Language.Parser]::ParseFile($file.FullName,[ref]$tokens,[ref]$errors) | Out-Null
     if ($errors.Count) {throw ($errors | Out-String)}
 }
-foreach ($suite in @('Run-Tests.ps1','Run-AppTests.ps1','Run-OfflineUpdateTests.ps1','Run-FeatureTests.ps1','Run-CleanupTests.ps1')) {& (Join-Path $PSScriptRoot $suite)}
+foreach ($suite in @('Run-Tests.ps1','Run-AppTests.ps1','Run-OfflineUpdateTests.ps1','Run-FeatureTests.ps1','Run-CleanupTests.ps1','Run-CaptureTests.ps1')) {& (Join-Path $PSScriptRoot $suite)}
 Write-Output 'All checks passed. No live policy or application mutations were performed.'

tests/Run-CaptureTests.ps1

@@ -0,0 +1,41 @@
+#Requires -Version 5.1
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$root=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
+Import-Module (Join-Path $root 'src/Wind.Network.psm1') -Force
+$script:passed=0
+function Assert-Capture([bool]$Condition,[string]$Message){if(-not$Condition){throw $Message};$script:passed++}
+$state=Join-Path ([IO.Path]::GetTempPath()) ('ms-private-capture-test-'+[guid]::NewGuid().ToString('N'))
+try{
+    $candidate=Join-Path $state 'capture-one'
+    $resolved=Resolve-WindCaptureDirectory -Path $candidate -StateRoot $state
+    Assert-Capture ($resolved-eq$candidate-and-not(Test-Path -LiteralPath $candidate)) 'Capture resolution created a directory or changed the target.'
+    foreach($invalid in @($state,($state+'-sibling\capture'),(Join-Path $state '..\outside'),'relative\capture','C:relative','\relative','\\server\share',($candidate+':stream'))){
+        $threw=$false;try{Resolve-WindCaptureDirectory -Path $invalid -StateRoot $state|Out-Null}catch{$threw=$true}
+        Assert-Capture $threw "Unsafe capture path accepted: $invalid"
+    }
+    [IO.Directory]::CreateDirectory($state)|Out-Null
+    $file=Join-Path $state 'file';[IO.File]::WriteAllText($file,'test')
+    $threw=$false;try{Resolve-WindCaptureDirectory -Path (Join-Path $file 'child') -StateRoot $state|Out-Null}catch{$threw=$true}
+    Assert-Capture $threw 'Capture path crossed an existing file.'
+
+    $calls=[Collections.Generic.List[string]]::new()
+    $runner={param($NativeArguments)$calls.Add(($NativeArguments-join'|'));0}.GetNewClosure()
+    Invoke-WindPacketMonitor -ArgumentList @('start','--file-name','path with spaces\capture.etl') -Runner $runner
+    Assert-Capture ($calls.Count-eq1-and$calls[0]-eq'start|--file-name|path with spaces\capture.etl') 'Packet monitor changed native argument boundaries.'
+    $threw=$false;try{Invoke-WindPacketMonitor -ArgumentList @('start') -Runner {23}}catch{$threw=$_.Exception.Message-match'exit code 23'}
+    Assert-Capture $threw 'Packet monitor failure was reported as success.'
+    $threw=$false;try{Invoke-WindPacketMonitor -ArgumentList @('stop') -Runner {}}catch{$threw=$true}
+    Assert-Capture $threw 'Missing packet monitor exit code was reported as success.'
+
+    # Real entry points must return before privilege checks, directory creation or native commands.
+    $preview=Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) ('MsPrivate\network\preview-test-'+[guid]::NewGuid().ToString('N'))
+    & (Join-Path $root 'Network.ps1') -Mode CaptureStart -CaptureDirectory $preview -WhatIf
+    & (Join-Path $root 'Network.ps1') -Mode CaptureStop -CaptureDirectory $preview -WhatIf
+    Assert-Capture (-not(Test-Path -LiteralPath $preview)) 'Capture preview created state on disk.'
+}finally{
+    $full=[IO.Path]::GetFullPath($state);$temp=[IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\')+'\'
+    if(-not$full.StartsWith($temp,[StringComparison]::OrdinalIgnoreCase)){throw 'Unsafe test cleanup path.'}
+    if([IO.Directory]::Exists($full)){[IO.Directory]::Delete($full,$true)}
+}
+Write-Output "$script:passed capture tests passed. No packet capture or firewall change was performed."

tests/Run-CleanupTests.ps1

@@ -8,19 +8,17 @@ $script:passed=0
 function Assert-Cleanup([bool]$Condition,[string]$Message){if(-not$Condition){throw $Message};$script:passed++}
 try{
     $files=Join-Path $scratch 'files';[IO.Directory]::CreateDirectory($files)|Out-Null
-    # Replace only the catalog in this module instance: all deletions stay in this test's directory.
-    & $module {
-        param($TestRoot)
-        $script:cleanupTestRoot=$TestRoot
-        function script:Get-WindPrivacyCleanupCatalog {
-            [pscustomobject]@{Category='Temp';Root=$script:cleanupTestRoot;Patterns=@('*');Recurse=$true}
-        }
-    } $files
+    # Use the production allowlist and an exact one-file plan; never scan or select other Temp files.
+    $tempRoot=[IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\')
     $file=Join-Path $files 'sample.txt';$report=Join-Path $scratch 'report.json'
     function New-TestCleanupPlan {
         [IO.File]::WriteAllText($file,'original')
         [IO.File]::SetLastWriteTimeUtc($file,[DateTime]::UtcNow.AddDays(-30))
-        Get-WindCleanupPlan -AgeDays 7 -Category Temp
+        $item=Get-Item -LiteralPath $file
+        [pscustomobject]@{
+            Schema=2;AgeDays=7;CutoffUtc=[DateTime]::UtcNow.AddDays(-7).ToString('o');Categories=@('Temp')
+            Files=@([pscustomobject]@{Path=$item.FullName;Root=$tempRoot;Category='Temp';Length=$item.Length;LastWriteUtc=$item.LastWriteTimeUtc.ToString('o')})
+        }
     }
 
     $plan=New-TestCleanupPlan