@@ -16,16 +16,25 @@ function expectBindMountsToThrow(binds: string[], expected: RegExp, label: strin
1616expect(() => validateBindMounts(binds), label).toThrow(expected);
1717}
181819+function expectBlockedTargetReason(
20+bind: string,
21+): Extract<NonNullable<ReturnType<typeof getBlockedBindReason>>, { kind: "targets" }> {
22+const reason = getBlockedBindReason(bind);
23+expect(reason?.kind).toBe("targets");
24+if (reason?.kind !== "targets") {
25+throw new Error(`expected blocked target reason for ${bind}`);
26+}
27+return reason;
28+}
29+1930describe("getBlockedBindReason", () => {
2031afterEach(() => {
2132vi.unstubAllEnvs();
2233});
23342435it("blocks common Docker socket directories", () => {
25-expect(getBlockedBindReason("/run:/run")).toEqual(expect.objectContaining({ kind: "targets" }));
26-expect(getBlockedBindReason("/var/run:/var/run:ro")).toEqual(
27-expect.objectContaining({ kind: "targets" }),
28-);
36+expectBlockedTargetReason("/run:/run");
37+expectBlockedTargetReason("/var/run:/var/run:ro");
2938});
30393140it("does not block /var by default", () => {
@@ -47,22 +56,16 @@ describe("getBlockedBindReason", () => {
4756] as const;
48574958for (const source of cases) {
50-expect(getBlockedBindReason(`${source}:/mnt/test:ro`)).toEqual(
51-expect.objectContaining({ kind: "targets" }),
52-);
59+expectBlockedTargetReason(`${source}:/mnt/test:ro`);
5360}
5461});
55625663it("still blocks OS-home credential paths when OPENCLAW_HOME points elsewhere", () => {
5764vi.stubEnv("HOME", "/home/tester");
5865vi.stubEnv("OPENCLAW_HOME", "/srv/openclaw-home");
596660-expect(getBlockedBindReason("/home/tester/.gnupg/secring.gpg:/mnt/gnupg:ro")).toEqual(
61-expect.objectContaining({
62-kind: "targets",
63-blockedPath: "/home/tester/.gnupg",
64-}),
65-);
67+const reason = expectBlockedTargetReason("/home/tester/.gnupg/secring.gpg:/mnt/gnupg:ro");
68+expect(reason?.blockedPath).toBe("/home/tester/.gnupg");
6669});
67706871it("blocks canonical OS-home aliases for credential paths", () => {
@@ -77,12 +80,8 @@ describe("getBlockedBindReason", () => {
7780symlinkSync(realHome, aliasHome);
7881vi.stubEnv("HOME", aliasHome);
798280-expect(getBlockedBindReason(`${join(realHome, ".ssh", "config")}:/mnt/ssh:ro`)).toEqual(
81-expect.objectContaining({
82-kind: "targets",
83-blockedPath: normalizePathForSnapshot(join(realHome, ".ssh")),
84-}),
85-);
83+const reason = expectBlockedTargetReason(`${join(realHome, ".ssh", "config")}:/mnt/ssh:ro`);
84+expect(reason?.blockedPath).toBe(normalizePathForSnapshot(join(realHome, ".ssh")));
8685});
8786});
8887此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。