From 66668ffdcdb50467a441172bd77b66047d23168f Mon Sep 17 00:00:00 2001
From: whyour <imwhyour@gmail.com>
Date: Sat, 22 Aug 2026 14:11:35 +0800
Subject: [PATCH] fix(ci): preserve console capacity helper input

---
 scripts/ql3-cluster-copilot-console-capacity-evidence.cjs   | 6 ++++++
 test/back/ql3ClusterCopilotConsoleCapacityEvidence.test.cjs | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/scripts/ql3-cluster-copilot-console-capacity-evidence.cjs b/scripts/ql3-cluster-copilot-console-capacity-evidence.cjs
index 45f5897e..577a40a8 100644
--- a/scripts/ql3-cluster-copilot-console-capacity-evidence.cjs
+++ b/scripts/ql3-cluster-copilot-console-capacity-evidence.cjs
@@ -816,11 +816,14 @@ function seedVolume(image, volume, root, files) {
     [
       'run',
       '--rm',
+      '--interactive',
       '--read-only',
       '--network',
       'none',
       '--cap-drop',
       'ALL',
+      '--cap-add',
+      'CHOWN',
       '--security-opt',
       'no-new-privileges',
       '--user',
@@ -842,11 +845,14 @@ function rotateAssertion(image, volume, assertion) {
     [
       'run',
       '--rm',
+      '--interactive',
       '--read-only',
       '--network',
       'none',
       '--cap-drop',
       'ALL',
+      '--cap-add',
+      'CHOWN',
       '--security-opt',
       'no-new-privileges',
       '--user',
diff --git a/test/back/ql3ClusterCopilotConsoleCapacityEvidence.test.cjs b/test/back/ql3ClusterCopilotConsoleCapacityEvidence.test.cjs
index 2d4ba0cc..83e7d85b 100644
--- a/test/back/ql3ClusterCopilotConsoleCapacityEvidence.test.cjs
+++ b/test/back/ql3ClusterCopilotConsoleCapacityEvidence.test.cjs
@@ -397,6 +397,8 @@ test('live source freezes native cgroup v2, isolation and assertion rotation mec
   ]) {
     assert.ok(scriptSource.includes(contract), `missing ${contract}`);
   }
+  assert.equal(scriptSource.match(/'--interactive'/g)?.length, 2);
+  assert.equal(scriptSource.match(/'--cap-add',\n      'CHOWN'/g)?.length, 2);
   assert.doesNotMatch(scriptSource, /run\.cancellation\.(?:rearm|stop|retry)/);
   assert.doesNotMatch(scriptSource, /--privileged|--network[= ]host/);
 });