Security
The fixtures run native tools, hooks and MCP processes with the test runner's OS authority. Temporary homes isolate configuration and state selection, but do not prevent one unsandboxed process from reading another accessible path.
Native permission rules
The native permission-rule fixture intentionally allows Bash to write a marker outside its working directory, within its own temporary folder. Native allowed rules can bypass the host permission callback. The tests do not turn Claude's permission mechanism into a Link grant or a sandbox.
The child processes' environment
Child processes receive a selected environment containing a synthetic provider
credential, fixture values, runtime metadata and the host's proxy and CA trust.
The provider binds to 127.0.0.1 on an ephemeral port. It has no external
inference route. The SDK's ordinary environment merge is replaced at the spawn
boundary so ambient account credentials do not reach the native subprocess.
The direct CLI comparator uses that same selected environment.
Transcripts and output
Native transcript files and the injected failing mirror contain only fixture content. Test output reports assertions and failures rather than dumping transcripts or request headers. SDK and native binaries are installed into ignored dependencies and are not redistributed in this repository.
Callbacks and settlement
A pending native callback is a process-local handle. An aborted callback or saved native permission is insufficient authority for a new execution attempt. A terminal foreground result and an interrupt acknowledgement are insufficient to establish that background writers have settled.