@@ -107,28 +107,37 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
107107sendInvokeResult: MockedSendInvokeResult,
108108params?: { payloadContains?: string },
109109) {
110-expect(sendInvokeResult).toHaveBeenCalledWith(
111-expect.objectContaining({
112-ok: true,
113- ...(params?.payloadContains
114- ? { payloadJSON: expect.stringContaining(params.payloadContains) }
115- : {}),
116-}),
117-);
110+const result = requireInvokeResult(sendInvokeResult);
111+expect(result.ok).toBe(true);
112+if (params?.payloadContains) {
113+expect(result.payloadJSON).toContain(params.payloadContains);
114+}
118115}
119116120117function expectInvokeErrorMessage(
121118sendInvokeResult: MockedSendInvokeResult,
122119params: { message: string; exact?: boolean },
123120) {
124-expect(sendInvokeResult).toHaveBeenCalledWith(
125-expect.objectContaining({
126-ok: false,
127-error: expect.objectContaining({
128-message: params.exact ? params.message : expect.stringContaining(params.message),
129-}),
130-}),
131-);
121+const result = requireInvokeResult(sendInvokeResult);
122+expect(result.ok).toBe(false);
123+const message = result.error?.message;
124+if (params.exact) {
125+expect(message).toBe(params.message);
126+} else {
127+expect(message).toContain(params.message);
128+}
129+}
130+131+function requireInvokeResult(sendInvokeResult: MockedSendInvokeResult): {
132+ok?: boolean;
133+payloadJSON?: string;
134+error?: { message?: string };
135+} {
136+const result = sendInvokeResult.mock.calls[0]?.[0];
137+if (!result) {
138+throw new Error("expected sendInvokeResult payload");
139+}
140+return result as { ok?: boolean; payloadJSON?: string; error?: { message?: string } };
132141}
133142134143function requireFirstRunCommandArgs(runCommand: MockedRunCommand): string[] {
@@ -139,15 +148,34 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
139148return args;
140149}
141150151+function requireMacExecHostCall(runViaMacAppExecHost: MockedRunViaMacAppExecHost): {
152+approvals?: { agent?: { security?: string; ask?: string } };
153+request?: { command?: string[]; rawCommand?: string; cwd?: string };
154+} {
155+const call = runViaMacAppExecHost.mock.calls[0]?.[0];
156+if (!call) {
157+throw new Error("expected runViaMacAppExecHost call");
158+}
159+return call as {
160+approvals?: { agent?: { security?: string; ask?: string } };
161+request?: { command?: string[]; rawCommand?: string; cwd?: string };
162+};
163+}
164+165+function expectExecDeniedEvent(sendNodeEvent: MockedSendNodeEvent): void {
166+const call = sendNodeEvent.mock.calls[0];
167+if (!call) {
168+throw new Error("expected sendNodeEvent call");
169+}
170+expect(call[1]).toBe("exec.denied");
171+expect((call[2] as { reason?: string }).reason).toBe("approval-required");
172+}
173+142174function expectApprovalRequiredDenied(params: {
143175sendNodeEvent: MockedSendNodeEvent;
144176sendInvokeResult: MockedSendInvokeResult;
145177}) {
146-expect(params.sendNodeEvent).toHaveBeenCalledWith(
147-expect.anything(),
148-"exec.denied",
149-expect.objectContaining({ reason: "approval-required" }),
150-);
178+expectExecDeniedEvent(params.sendNodeEvent);
151179expectInvokeErrorMessage(params.sendInvokeResult, {
152180message: "SYSTEM_RUN_DENIED: approval required",
153181exact: true,
@@ -511,17 +539,10 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
511539runViaResponse: createMacExecHostSuccess(),
512540});
513541514-expect(macHostInvoke.runViaMacAppExecHost).toHaveBeenCalledWith({
515-approvals: expect.objectContaining({
516-agent: expect.objectContaining({
517-security: "full",
518-ask: "off",
519-}),
520-}),
521-request: expect.objectContaining({
522-command: ["echo", "ok"],
523-}),
524-});
542+const macHostCall = requireMacExecHostCall(macHostInvoke.runViaMacAppExecHost);
543+expect(macHostCall.approvals?.agent?.security).toBe("full");
544+expect(macHostCall.approvals?.agent?.ask).toBe("off");
545+expect(macHostCall.request?.command).toEqual(["echo", "ok"]);
525546expect(macHostInvoke.runCommand).not.toHaveBeenCalled();
526547expectInvokeOk(macHostInvoke.sendInvokeResult, { payloadContains: "app-ok" });
527548@@ -531,13 +552,18 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
531552runViaResponse: createMacExecHostSuccess(),
532553});
533554534-expect(shellWrapperInvoke.runViaMacAppExecHost).toHaveBeenCalledWith({
535-approvals: expect.anything(),
536-request: expect.objectContaining({
537-command: ["/bin/sh", "-lc", '$0 "$1"', "/usr/bin/touch", "/tmp/marker"],
538-rawCommand: '/bin/sh -lc "$0 \\"$1\\"" /usr/bin/touch /tmp/marker',
539-}),
540-});
555+const shellWrapperCall = requireMacExecHostCall(shellWrapperInvoke.runViaMacAppExecHost);
556+expect(shellWrapperCall.approvals).toBeDefined();
557+expect(shellWrapperCall.request?.command).toEqual([
558+"/bin/sh",
559+"-lc",
560+'$0 "$1"',
561+"/usr/bin/touch",
562+"/tmp/marker",
563+]);
564+expect(shellWrapperCall.request?.rawCommand).toBe(
565+'/bin/sh -lc "$0 \\"$1\\"" /usr/bin/touch /tmp/marker',
566+);
541567});
542568543569const approvedEnvShellWrapperCases = [
@@ -594,14 +620,11 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
594620if (testCase.preferMacAppExecHost) {
595621const canonicalCwd = fs.realpathSync(tmp);
596622expect(invoke.runCommand).not.toHaveBeenCalled();
597-expect(invoke.runViaMacAppExecHost).toHaveBeenCalledWith({
598-approvals: expect.anything(),
599-request: expect.objectContaining({
600-command: ["env", "sh", "-c", "echo SAFE"],
601-rawCommand: 'env sh -c "echo SAFE"',
602-cwd: canonicalCwd,
603-}),
604-});
623+const macHostCall = requireMacExecHostCall(invoke.runViaMacAppExecHost);
624+expect(macHostCall.approvals).toBeDefined();
625+expect(macHostCall.request?.command).toEqual(["env", "sh", "-c", "echo SAFE"]);
626+expect(macHostCall.request?.rawCommand).toBe('env sh -c "echo SAFE"');
627+expect(macHostCall.request?.cwd).toBe(canonicalCwd);
605628expectInvokeOk(invoke.sendInvokeResult, { payloadContains: "app-ok" });
606629continue;
607630}
@@ -1248,11 +1271,7 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
12481271});
1249127212501273expect(runCommand, testCase.command.join(" ")).not.toHaveBeenCalled();
1251-expect(sendNodeEvent, testCase.command.join(" ")).toHaveBeenCalledWith(
1252-expect.anything(),
1253-"exec.denied",
1254-expect.objectContaining({ reason: "approval-required" }),
1255-);
1274+expectExecDeniedEvent(sendNodeEvent);
12561275expectInvokeErrorMessage(sendInvokeResult, {
12571276message: testCase.expected,
12581277});
@@ -1279,11 +1298,7 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
12791298});
1280129912811300expect(runCommand).not.toHaveBeenCalled();
1282-expect(sendNodeEvent).toHaveBeenCalledWith(
1283-expect.anything(),
1284-"exec.denied",
1285-expect.objectContaining({ reason: "approval-required" }),
1286-);
1301+expectExecDeniedEvent(sendNodeEvent);
12871302expectInvokeErrorMessage(sendInvokeResult, {
12881303message: "awk inline program requires explicit approval in strictInlineEval mode",
12891304});
@@ -1361,9 +1376,9 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
1361137613621377expect(benign.runCommand).toHaveBeenCalledTimes(1);
13631378expectInvokeOk(benign.sendInvokeResult, { payloadContains: "awk-ok" });
1364-expect(loadExecApprovals().agents?.main?.allowlist ?? []).toEqual([
1365- expect.objectContaining({ pattern: executablePath }),
1366-]);
1379+const allowlist = loadExecApprovals().agents?.main?.allowlist ?? [];
1380+expect(allowlist).toHaveLength(1);
1381+expect(allowlist[0]?.pattern).toBe(executablePath);
1367138213681383const malicious = await runSystemInvoke({
13691384preferMacAppExecHost: false,
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。