// Verifies sandbox config merge precedence across global, agent, and shared scopes.

import { describe, expect, it } from "vitest";

import {

resolveSandboxBrowserConfig,

});

it("resolves docker binds and shared-scope override behavior", () => {

// Shared scope intentionally ignores agent-specific Docker overrides.

for (const scenario of [

{

name: "merges sandbox docker binds (global + agent combined)",

// Verifies sandbox media path admission for workspace, tmp, managed, and remote sources.

import fs from "node:fs/promises";

import os from "node:os";

import path from "node:path";

import { resolveAllowedManagedMediaPath, resolveSandboxedMediaSource } from "./sandbox-paths.js";

async function withSandboxRoot<T>(run: (sandboxDir: string) => Promise<T>) {

// Real temp roots exercise path normalization and symlink/hardlink behavior.

const sandboxDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-media-"));

try {

return await run(sandboxDir);

},

run: (paths: { hardlinkPath: string; symlinkPath?: string }) => Promise<T>,

): Promise<void> {

// Hardlinks in allowed temp roots must still be rejected when inode points outside.

const outsideDir = await fs.mkdtemp(path.join(process.cwd(), "sandbox-media-hardlink-outside-"));

const outsideFile = path.join(outsideDir, "outside-secret.txt");

const hardlinkPath = path.join(params.openClawTmpDir, makeTmpProbePath(params.hardlinkPrefix));

// Verifies Windows drive-letter paths are treated as absolute under POSIX hosts.

import path from "node:path";

import { describe, expect, it } from "vitest";

import { resolveToolPathAgainstWorkspaceRoot } from "./agent-tools.read.js";

// Verifies sandbox tool allow/deny policy extraction and additive alsoAllow behavior.

import { describe, expect, it } from "vitest";

import type { OpenClawConfig } from "../config/config.js";

import { resolveEffectiveToolPolicy } from "./agent-tools.policy.js";

});

it("preserves allow-all semantics for allow: [] plus alsoAllow", () => {

// Empty allow means allow-all; alsoAllow remains additive, not restrictive.

expect(

pickSandboxToolPolicy({

allow: [],

// Verifies sandbox context resolution, backend registration, and main-session bypass.

import fs from "node:fs/promises";

import os from "node:os";

import path from "node:path";

let sandboxFixtureCount = 0;

async function createSandboxFixtureDir(prefix: string): Promise<string> {

// Shared fixture root avoids repeated temp-dir setup across sandbox context cases.

const dir = path.join(sandboxFixtureRoot, `${prefix}-${sandboxFixtureCount++}`);

await fs.mkdir(dir, { recursive: true });

return dir;

}, 15_000);

it("does not touch sandbox backends for cron or sub-agent sessions when sandbox mode is off", async () => {

// Mode=off should short-circuit before resolving any backend implementation.

const backendFactory = vi.fn(async () => ({

id: "test-off-backend",

runtimeId: "unexpected-runtime",

// Verifies prompt literals and data blocks strip control/spoofing characters.

import { describe, expect, it } from "vitest";

import {

sanitizeForPromptLiteral,