};

});

import { stageSandboxMedia } from "./reply/stage-sandbox-media.js";

import {

appendScpStderrTail,

SCP_STDERR_TAIL_CHARS,

stageSandboxMedia,

} from "./reply/stage-sandbox-media.js";

afterEach(() => {

vi.restoreAllMocks();

}

describe("stageSandboxMedia scp remote paths", () => {

it("keeps only the tail of noisy scp stderr", () => {

const stderr = appendScpStderrTail("start-", `${"x".repeat(SCP_STDERR_TAIL_CHARS)}-end`);

expect(stderr).toHaveLength(SCP_STDERR_TAIL_CHARS);

expect(stderr).toContain("-end");

expect(stderr).not.toContain("start-");

});

it("rejects remote attachment filenames with shell metacharacters before spawning scp", async () => {

await withSandboxMediaTempHome("openclaw-triggers-", async (home) => {

const { cfg, workspaceDir, sessionKey, remoteCacheDir } = createRemoteStageParams(home);

import type { MsgContext, TemplateContext } from "../templating.js";

const STAGED_MEDIA_MAX_BYTES = MEDIA_MAX_BYTES;

export const SCP_STDERR_TAIL_CHARS = 16_384;

// `staged` maps every absolute source path that was copied into the sandbox

// (or remote cache) to its rewritten ctx path. Callers like chat.send's

let stderr = "";

child.stderr?.setEncoding("utf8");

child.stderr?.on("data", (chunk) => {

stderr += chunk;

stderr = appendScpStderrTail(stderr, chunk);

});

child.once("error", reject);

});

});

}

export function appendScpStderrTail(

current: string,

chunk: string,

maxChars = SCP_STDERR_TAIL_CHARS,

): string {

const combined = `${current}${chunk}`;

if (combined.length <= maxChars) {

return combined;

}

return combined.slice(-maxChars);

}