@@ -541,7 +541,7 @@ describe("handshake auth helpers", () => {
541541).toBe("remote");
542542});
543543544-it("allows silent scope-upgrade for shared_secret_loopback_local", () => {
544+it("allows silent scope-upgrade, role-upgrade, and metadata-upgrade for shared_secret_loopback_local", () => {
545545expect(
546546shouldAllowSilentLocalPairing({
547547locality: "shared_secret_loopback_local",
@@ -560,6 +560,8 @@ describe("handshake auth helpers", () => {
560560reason: "role-upgrade",
561561}),
562562).toBe(true);
563+// metadata-upgrade now auto-approves for shared_secret_loopback_local
564+// (extended allowlist — see shouldAllowSilentLocalPairing).
563565expect(
564566shouldAllowSilentLocalPairing({
565567locality: "shared_secret_loopback_local",
@@ -568,7 +570,57 @@ describe("handshake auth helpers", () => {
568570isWebchat: false,
569571reason: "metadata-upgrade",
570572}),
571-).toBe(false);
573+).toBe(true);
574+});
575+576+describe("shouldAllowSilentLocalPairing — metadata-upgrade reason", () => {
577+it("allows silent metadata-upgrade for cli_container_local CLI clients", () => {
578+expect(
579+shouldAllowSilentLocalPairing({
580+locality: "cli_container_local",
581+hasBrowserOriginHeader: false,
582+isControlUi: false,
583+isWebchat: false,
584+reason: "metadata-upgrade",
585+}),
586+).toBe(true);
587+});
588+589+it("allows silent metadata-upgrade for shared_secret_loopback_local CLI clients", () => {
590+expect(
591+shouldAllowSilentLocalPairing({
592+locality: "shared_secret_loopback_local",
593+hasBrowserOriginHeader: false,
594+isControlUi: false,
595+isWebchat: false,
596+reason: "metadata-upgrade",
597+}),
598+).toBe(true);
599+});
600+601+it("still requires approval for metadata-upgrade from remote clients", () => {
602+expect(
603+shouldAllowSilentLocalPairing({
604+locality: "remote",
605+hasBrowserOriginHeader: false,
606+isControlUi: false,
607+isWebchat: false,
608+reason: "metadata-upgrade",
609+}),
610+).toBe(false);
611+});
612+613+it("still requires approval for metadata-upgrade from browser_container_local (Control UI)", () => {
614+expect(
615+shouldAllowSilentLocalPairing({
616+locality: "browser_container_local",
617+hasBrowserOriginHeader: true,
618+isControlUi: true,
619+isWebchat: false,
620+reason: "metadata-upgrade",
621+}),
622+).toBe(false);
623+});
572624});
573625574626it("prefers cli_container_local over shared_secret_loopback_local for CLI clients", () => {
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。