@@ -119,37 +119,38 @@ describe("doctor exec safe bin helpers", () => {
119119120120it("flags safeBins that resolve outside trusted directories", () => {
121121const tempDir = mkdtempSync(join(tmpdir(), "openclaw-safe-bin-"));
122-const binPath = join(tempDir, "custom-safe-bin");
123-writeFileSync(binPath, "#!/bin/sh\nexit 0\n");
124-chmodSync(binPath, 0o755);
125-process.env.PATH = [tempDir, originalPath].filter((entry) => entry.length > 0).join(delimiter);
126-127-const hits = scanExecSafeBinTrustedDirHints({
128-tools: {
129-exec: {
130-safeBins: ["custom-safe-bin"],
131-safeBinProfiles: { "custom-safe-bin": {} },
122+try {
123+const binPath = join(tempDir, "custom-safe-bin");
124+writeFileSync(binPath, "#!/bin/sh\nexit 0\n");
125+chmodSync(binPath, 0o755);
126+process.env.PATH = [tempDir, originalPath]
127+.filter((entry) => entry.length > 0)
128+.join(delimiter);
129+130+const hits = scanExecSafeBinTrustedDirHints({
131+tools: {
132+exec: {
133+safeBins: ["custom-safe-bin"],
134+safeBinProfiles: { "custom-safe-bin": {} },
135+},
132136},
133-},
134-} as OpenClawConfig);
137+} as OpenClawConfig);
135138136-expect(hits).toHaveLength(1);
137-const hit = hits[0];
138-if (!hit) {
139-throw new Error("expected trusted-dir hint hit");
139+expect(hits).toStrictEqual([
140+{
141+scopePath: "tools.exec",
142+bin: "custom-safe-bin",
143+resolvedPath: binPath,
144+},
145+]);
146+147+const warnings = collectExecSafeBinTrustedDirHintWarnings(hits);
148+expect(warnings).toStrictEqual([
149+`- tools.exec.safeBins entry 'custom-safe-bin' resolves to '${binPath}' outside trusted safe-bin dirs.`,
150+"- If intentional, add the binary directory to tools.exec.safeBinTrustedDirs (global or agent scope).",
151+]);
152+} finally {
153+rmSync(tempDir, { recursive: true, force: true });
140154}
141-expect(hit.scopePath).toBe("tools.exec");
142-expect(hit.bin).toBe("custom-safe-bin");
143-expect(hit.resolvedPath).toBe(binPath);
144-145-const warnings = collectExecSafeBinTrustedDirHintWarnings(hits);
146-expect(
147-warnings.some((warning) => warning.includes("tools.exec.safeBins entry 'custom-safe-bin'")),
148-).toBe(true);
149-expect(warnings.some((warning) => warning.includes("tools.exec.safeBinTrustedDirs"))).toBe(
150-true,
151-);
152-153-rmSync(tempDir, { recursive: true, force: true });
154155});
155156});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。