import {

capEntryCount,

getActiveSessionMaintenanceWarning,

pruneQuotaSuspensions,

pruneStaleEntries,

shouldRunSessionEntryMaintenance,

type QuotaSuspensionMaintenanceResult,

type ResolvedSessionMaintenanceConfig,

type SessionMaintenanceWarning,

} from "./store-maintenance.js";

forceMaintenance,

});

}

/**

* Applies quota-suspension TTL maintenance to a store image.

*

* SQLite should implement this as a row transaction that returns the resumed

* lane records and clear count before callers resume in-process quota lanes.

*/

export function applyQuotaSuspensionTtlMaintenance(params: {

store: Record<string, SessionEntry>;

now: number;

ttlMs?: number;

log?: boolean;

}): QuotaSuspensionMaintenanceResult {

return pruneQuotaSuspensions(params);

}

import crypto from "node:crypto";

import { afterAll, beforeAll, describe, expect, it } from "vitest";

import { createFixtureSuite } from "../../test-utils/fixture-suite.js";

import {

applyFileBackedSessionStoreMaintenance,

applyQuotaSuspensionTtlMaintenance,

} from "./store-maintenance-operations.js";

import { applyFileBackedSessionStoreMaintenance } from "./store-maintenance-operations.js";

import {

collectSessionMaintenancePreserveKeys,

registerSessionMaintenancePreserveKeysProvider,

} from "./store-maintenance-preserve.js";

import {

isProtectedSessionMaintenanceEntry,

resolveMaintenanceConfigFromInput,

pruneQuotaSuspensions,

resolveQuotaSuspensionEntryMaintenance,

resolveSessionEntryMaintenanceHighWater,

} from "./store-maintenance.js";

});

});

describe("applyQuotaSuspensionTtlMaintenance", () => {

describe("pruneQuotaSuspensions", () => {

it("returns whole-store resume and clear results from the storage-neutral operation", () => {

const now = Date.now();

const store = makeStore([

],

]);

const result = applyQuotaSuspensionTtlMaintenance({

const result = pruneQuotaSuspensions({

store,

now,

ttlMs: 30_000,

SAFE_BIN_PROFILES,

resolveSafeBinProfiles,

} from "./exec-safe-bin-policy.js";

import { buildTrustedSafeBinDirs } from "./exec-safe-bin-trust.js";

import { getTrustedSafeBinDirs } from "./exec-safe-bin-trust.js";

describe("exec approvals safe bins", () => {

type SafeBinCase = {

argv: ["jq", ".foo"],

resolution,

safeBins: normalizeSafeBins(["jq"]),

trustedSafeBinDirs: buildTrustedSafeBinDirs({

trustedSafeBinDirs: getTrustedSafeBinDirs({

extraDirs: ["/opt/homebrew/Cellar/jq/1.7.1/bin"],

refresh: true,

}),

}),

).toBe(true);

import { withTempDir } from "../test-helpers/temp-dir.js";

import { withEnv } from "../test-utils/env.js";

import {

buildTrustedSafeBinDirs,

getTrustedSafeBinDirs,

isTrustedSafeBinPath,

listWritableExplicitTrustedSafeBinDirs,

});

it("builds trusted dirs from defaults and explicit extra dirs", () => {

const dirs = buildTrustedSafeBinDirs({

const dirs = getTrustedSafeBinDirs({

baseDirs: ["/usr/bin"],

extraDirs: ["/custom/bin", "/alt/bin", "/custom/bin"],

refresh: true,

});

expect(dirs.has(path.resolve("/usr/bin"))).toBe(true);

return;

}

const dirs = buildTrustedSafeBinDirs({

const dirs = getTrustedSafeBinDirs({

baseDirs: [],

extraDirs: [swapped],

refresh: true,

});

expect(

return;

}

const dirs = buildTrustedSafeBinDirs({

const dirs = getTrustedSafeBinDirs({

baseDirs: [],

extraDirs: [trustedDir],

refresh: true,

});

expect(

// User/package-manager bins must be opted in via tools.exec.safeBinTrustedDirs.

const DEFAULT_SAFE_BIN_TRUSTED_DIRS = ["/bin", "/usr/bin"];

type TrustedSafeBinDirsParams = {

baseDirs?: readonly string[];

extraDirs?: readonly string[];

safeBins?: readonly string[];

};

type TrustedSafeBinPathParams = {

resolvedPath: string;

trustedDirs?: ReadonlySet<string>;

return `${dirsKey}\u0002${binsKey}\u0002${targetDirsKey}`;

}

export function buildTrustedSafeBinDirs(params: TrustedSafeBinDirsParams = {}): Set<string> {

const baseDirs = params.baseDirs ?? DEFAULT_SAFE_BIN_TRUSTED_DIRS;

const extraDirs = params.extraDirs ?? [];

const safeBins = params.safeBins ?? [];

// Trust is explicit only. Do not derive from PATH, which is user/environment controlled.

const entries = [

...normalizeTrustedSafeBinDirs(baseDirs),

...normalizeTrustedSafeBinDirs(extraDirs),

];

const targetDirs = resolveTrustedSafeBinTargetDirs(entries, safeBins);

return new Set([...resolveTrustedSafeBinDirs(entries), ...targetDirs]);

}

export function getTrustedSafeBinDirs(

params: {

baseDirs?: readonly string[];

import {

clearPluginStateStoreForTests,

closePluginStateDatabase,

createCorePluginStateKeyedStore,

createCorePluginStateSyncKeyedStore,

createPluginStateKeyedStore,

createPluginStateSyncKeyedStore,

PluginStateStoreError,

it("allows core owners and reserves core-prefixed plugin ids", async () => {

await withPluginStateTestState(async () => {

const store = createCorePluginStateKeyedStore<{ stopped: boolean }>({

const store = createCorePluginStateSyncKeyedStore<{ stopped: boolean }>({

ownerId: "core:channel-intent",

namespace: "stopped",

maxEntries: 10,

});

await store.register("telegram:personal", { stopped: true });

await expect(store.lookup("telegram:personal")).resolves.toEqual({ stopped: true });

store.register("telegram:personal", { stopped: true });

expect(store.lookup("telegram:personal")).toEqual({ stopped: true });

expect(() =>

createPluginStateKeyedStore("core:not-a-plugin", { namespace: "bad", maxEntries: 10 }),

).toThrow(PluginStateStoreError);

return createSyncKeyedStoreForPluginId<T>(pluginId, options);

}

/** Opens an async plugin-state namespace for a trusted core owner id. */

export function createCorePluginStateKeyedStore<T>(

options: OpenKeyedStoreOptions & { ownerId: `core:${string}` },

): PluginStateKeyedStore<T> {

return createKeyedStoreForPluginId<T>(options.ownerId, options);

}

/** Opens a sync plugin-state namespace for a trusted core owner id. */

export function createCorePluginStateSyncKeyedStore<T>(

options: OpenKeyedStoreOptions & { ownerId: `core:${string}` },

resolvePendingSkillProposal,

reviseSkillProposal,

} from "./service.js";

import {

readSkillProposalManifest,

resolveProposalDraftPath,

updateSkillProposalRecord,

} from "./store.js";

import { readSkillProposalManifest, updateSkillProposalRecord } from "./store.js";

const tempDirs = createTrackedTempDirs();

let testState: OpenClawTestState;

expect(proposal.record.target.skillFile).toBe(

path.join(workspaceDir, "skills", "weather-helper", "SKILL.md"),

);

await expect(

fs.readFile(resolveProposalDraftPath(proposal.record.id), "utf8"),

).resolves.toContain("date: ");

expect(proposal.content).toContain("date: ");

const listed = await listSkillProposals();

expect(listed.proposals).toHaveLength(1);

return path.resolve(options.stateDir ?? resolveStateDir(options.env));

}

function resolveProposalDir(

proposalId: string,

options: SkillWorkshopStoreOptions = {},

): string {

function resolveProposalDir(proposalId: string, options: SkillWorkshopStoreOptions = {}): string {

assertProposalId(proposalId);

return path.join(resolveSkillWorkshopStateDir(options), proposalRelativeDir(proposalId));

}

return path.join(resolveProposalDir(proposalId, options), PROPOSAL_RECORD_FILE);

}

export function resolveProposalDraftPath(

proposalId: string,

options: SkillWorkshopStoreOptions = {},

): string {

return path.join(resolveProposalDir(proposalId, options), PROPOSAL_DRAFT_FILE);

}

export function prepareSkillProposalSupportFiles(

input: readonly SkillProposalSupportFileInput[] | undefined,

): PreparedSkillProposalSupportFile[] {