[penso]

Summary

• Add isolated Windows named-pipe tests for generic read/write grants, the daemon's System/Owner Rights descriptor, and preservation of access-denied errors.
• Cover config maintenance-lock contention and Windows read-only lock failures, including native error context and preservation of the existing configuration.
• Document the actual Windows open flags, source comparisons, and evidence needed from the affected installation.
• Fix an existing clipboard-test timing assertion that counted serialization and payload verification against the worker's partial-frame receive deadline. Keep the actual worker deadline, bounded receive wait, full payload checks, and cancellation assertions.

Related to #357. The reported access denial remains unresolved; these tests and investigation notes do not establish a fix.

QA

• just format and git diff --cached --check passed.
• (umask 022; cargo test --locked -p herdr-gpui --bin herdr-gpui herdr_settings::tests) passed: 45 tests. The initial just ci run failed 25 existing settings tests because the inherited umask 002 created group-writable fixtures.
• (umask 022; RUST_TEST_THREADS=2 cargo test --locked -p herdr-client --lib tests::clipboard_tests::session::uploads) passed: 8 tests after correcting the timing assertion. Earlier full runs exposed the assertion failure under CPU contention.
• (umask 022; RUST_TEST_THREADS=2 just ci) passed on final commit 820fc4be35e4d5286c3625d0c2937442efc5c6e3 after merging origin/main (Linux x86_64): formatting, file-size/sorting gates, workspace Clippy, default/all-feature tests, doctests, and Python checks.
• just check-commits and git diff origin/main...HEAD --check passed.
• just lint-linux: attempted, blocked because Docker is unavailable. The native Linux Clippy checks are included in just ci.
• PATH="/tmp/opencode/issue-357-mingw/root/usr/bin:$PATH" just lint-windows passed with a user-local MinGW C/C++ toolchain: all targets with all features and without default features. Corrected the Windows-only listener path type and config-test unwrap_err lint found by CI.
• GitHub CI run 40589412773 passed: native Windows x64 and ARM64 workspace tests with default/all features (including the access and lock-access tests), Windows native GUI checks, and Linux/macOS checks.
• On the affected installation, reproduce discovery and explicit-socket connections, collect operation-specific errors, and compare the pipe opens and config-lock security state as described in docs/windows-local-access.md.

Native Windows and live GUI checks passed in GitHub CI; they were not run locally.

[penso]

Local CI verification: just ci ran locally and passed on commit 820fc4be35e4d5286c3625d0c2937442efc5c6e3, Linux x86_64, after merging origin/main, using (umask 022; RUST_TEST_THREADS=2 just ci). Also passed: just lint-windows with a user-local MinGW C/C++ toolchain (all targets/all features and no-default-features), just check-commits, and git diff origin/main...HEAD --check. just lint-linux remains blocked by missing Docker; native Linux Clippy passed in just ci.

GitHub CI run https://github.com/penso/herdr-gpui/actions/runs/40589412773 is now green, including all four Windows check jobs (x64/ARM64, default/all features), both Windows native GUI jobs, and Linux/macOS checks. Both Windows failures are resolved. Remaining affected-installation QA is listed in the PR description.

[greptile-apps]

Confidence Score: 5/5

[Low impact] This PR appears safe to merge; no actionable issue was found.

Summary

Adds isolated tests and investigation notes for Windows access failures. It does not change production access checks or claim to fix the reported denial.

• Windows pipe tests check allowed rights and denied writes.
• Config lock tests cover contention and Windows read-only files.
• Clipboard progress checks no longer time payload verification.

_{Reviews (1) · Last reviewed commit: "test: measure clipboard progress through..." · Reviewed by Greptile}