惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
Cisco Talos Blog
Cisco Talos Blog
T
Threat Research - Cisco Blogs
P
Privacy International News Feed
S
Schneier on Security
P
Privacy & Cybersecurity Law Blog
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
云风的 BLOG
云风的 BLOG
P
Proofpoint News Feed
Scott Helme
Scott Helme
人人都是产品经理
人人都是产品经理
G
GRAHAM CLULEY
O
OpenAI News
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
PCI Perspectives
PCI Perspectives
GbyAI
GbyAI
宝玉的分享
宝玉的分享
Y
Y Combinator Blog
T
Troy Hunt's Blog
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
C
CXSECURITY Database RSS Feed - CXSecurity.com
腾讯CDC
C
Check Point Blog
Spread Privacy
Spread Privacy
L
LINUX DO - 最新话题
Recent Announcements
Recent Announcements
大猫的无限游戏
大猫的无限游戏
P
Palo Alto Networks Blog
Hacker News: Ask HN
Hacker News: Ask HN
M
MIT News - Artificial intelligence
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
The Hacker News
The Hacker News
H
Hacker News: Front Page
Microsoft Azure Blog
Microsoft Azure Blog
I
InfoQ
T
Tor Project blog
Martin Fowler
Martin Fowler
博客园 - 叶小钗
罗磊的独立博客
C
Cyber Attacks, Cyber Crime and Cyber Security
H
Heimdal Security Blog
V
Vulnerabilities – Threatpost
Simon Willison's Weblog
Simon Willison's Weblog
Latest news
Latest news
WordPress大学
WordPress大学
G
Google Developers Blog
N
Netflix TechBlog - Medium
S
Security Affairs
S
Secure Thoughts
Know Your Adversary
Know Your Adversary

Recent Commits to openclaw:main

test: merge chat side-result checks · openclaw/openclaw@ddd2c2a test: merge cron history checks · openclaw/openclaw@f7eb746 test: merge responsive navigation shell checks · openclaw/openclaw@c2e4b47 docs(changelog): add codex oauth fixes · openclaw/openclaw@628e6cd test: merge navigation routing cases · openclaw/openclaw@5d8cecb Tests: mock channel registry bundled fallback · openclaw/openclaw@2b08233 Secrets: avoid broad web search discovery for single plugin config · openclaw/openclaw@a464f59 test: merge config view browser checks · openclaw/openclaw@20cf511 fix(status): align oauth health with runtime · openclaw/openclaw@eed7116 feat: add macOS screen snapshots for monitor preview (#67954) thanks … · openclaw/openclaw@f377db1 fix: report shared auth scopes in hello-ok (#67810) thanks @BunsDev · openclaw/openclaw@0b6c39b Auto-reply: avoid eager bundled route fallback · openclaw/openclaw@3ea1bf4 Tests: narrow session binding contract setup · openclaw/openclaw@54e4e16 fix(macOS): enable undo/redo in webchat composer text input (#34962) · openclaw/openclaw@00951dc Tests: speed up channel setup promotion · openclaw/openclaw@82b529a Docs: refresh agent instructions · openclaw/openclaw@5775fe2 fix(auth): serialize OAuth refresh across agents to fix #26322 (#67876) · openclaw/openclaw@8e79080 test: allow ollama public surface boundary test · openclaw/openclaw@7d4f1a6 Docs: add test performance guardrails · openclaw/openclaw@89706d3 Tests: restore context-engine usage proof · openclaw/openclaw@e4c4f95 Tests: slim context engine runtime coverage · openclaw/openclaw@74c198f ci: retry failed custom checkouts · openclaw/openclaw@0ee5baf test: trim duplicate provider auth onboarding cases · openclaw/openclaw@1ffc02e matrix: fix sessions_spawn --thread subagent session spawning (#67643) · openclaw/openclaw@1ce2596 test: reduce auth choice fixture churn · openclaw/openclaw@857b9cd test: mock health status config boundaries · openclaw/openclaw@9d5ab4a test: mock onboard config io boundary · openclaw/openclaw@299694d test: mock legacy state plugin boundaries · openclaw/openclaw@2713089 test: mock channel install boundaries · openclaw/openclaw@b945248 test: mock doctor preview channel boundaries · openclaw/openclaw@b1a3ad4 test: trim doctor command hotspots · openclaw/openclaw@c66f16a test: isolate agent auth and spawn hotspots · openclaw/openclaw@9285935 test: stabilize MCP startup disposal race · openclaw/openclaw@dd9d2eb test: merge browser contract server suites · openclaw/openclaw@5817a76 test: narrow ollama provider discovery setup · openclaw/openclaw@a0d9598 build: declare qa-lab aimock runtime dependency · openclaw/openclaw@24431e5 test: speed up safe-bins exec harness · openclaw/openclaw@ee856ab test: preserve tool helpers in embedded runner mocks · openclaw/openclaw@acd86a0 refactor: move memory embeddings into provider plugins · openclaw/openclaw@77e6e4c test: reuse system-run temp fixtures · openclaw/openclaw@7e9ff0f test: trim hotspot wait overhead · openclaw/openclaw@12a59b0 Check: avoid duplicate boundary prep · openclaw/openclaw@baf11b8 test: reduce hotspot fixture overhead · openclaw/openclaw@3a59edd feat(ui): overhaul settings and slash command UX (#67819) thanks @Bun… · openclaw/openclaw@2cfb660 QA Matrix: exit cleanly on failure · openclaw/openclaw@42805d2 QA Matrix: isolate scenario coverage · openclaw/openclaw@7e659e1 Matrix: refresh crypto bootstrap state · openclaw/openclaw@94081d8 QA Lab: add provider registry · openclaw/openclaw@bb7e982 Matrix: add plugin changelog · openclaw/openclaw@4acab55 test: trim more hotspot overhead · openclaw/openclaw@f485311 test: trim remaining hotspot tests · openclaw/openclaw@6ba8626 test: narrow hotspot mocks · openclaw/openclaw@dbc8179 test: isolate gemini embedding request helpers · openclaw/openclaw@cd330f5 test: trim memory and mcp hotspots · openclaw/openclaw@fd48dfa test: slim provider registry mocks · openclaw/openclaw@2e08c77 test: harden Parallels update smoke · openclaw/openclaw@1a98090 feat: default Anthropic to Opus 4.7 · openclaw/openclaw@628b454 fix: harden node-host shell payload mutability checks · openclaw/openclaw@75c551e fix: land node-host approval binding for native binaries (#66731) (th… · openclaw/openclaw@29919bb CI: add daily schedule to CodeQL workflow (#67645) · openclaw/openclaw@69d25f5 fix(gateway): capture config hash after plugin auto-enable to prevent… · openclaw/openclaw@8c11210 fix: repair sanitized replay tool results before send (#67620) (thank… · openclaw/openclaw@c3c7a99 fix: restrict HTML timeout short-circuit to transient statuses · openclaw/openclaw@de129a6 fix: keep TUI watchdog bound to active run (#67401) (thanks @xantorres) · openclaw/openclaw@3525273 Gateway/skills: dedupe skills prefix-match + drop dead fallback on log · openclaw/openclaw@d7f489f Extensions/lmstudio: back off inference preload after consecutive fai… · openclaw/openclaw@b555214 TUI/streaming: add watchdog that resets the activity indicator after … · openclaw/openclaw@f44ab20 Agents/tool-loop: enable unknown-tool stream guard by default · openclaw/openclaw@36ed367 Gateway/skills: invalidate session skills snapshot on config write · openclaw/openclaw@b23d59a fix: classify HTML provider error pages correctly (#67642) (thanks @s… · openclaw/openclaw@e588e90 fix(skills): remove unused model-usage import (#67641) · openclaw/openclaw@55f05df docs(changelog): credit codex fix superseded PRs · openclaw/openclaw@e485f24 fix(openai-codex): normalize stale transport metadata in resolution a… · openclaw/openclaw@90801ba CI: pin Docker-related GitHub Actions (#67632) · openclaw/openclaw@f697b01 Android: modernize WebView and discovery API usage (#67627) · openclaw/openclaw@44a6e50 fix(deps): bump hono to 4.12.14 and @hono/node-server to 1.19.14 (GHS… · openclaw/openclaw@fbccc18 fix(deps): bump dompurify to 3.4.0 (#67614) · openclaw/openclaw@2c2dc00 CI: add explicit permissions to all workflow jobs (fixes code-scannin… · openclaw/openclaw@01b7516 fix: register bundled TTS providers and route overrides correctly (#6… · openclaw/openclaw@6ea3cdd fix: align host tilde paths with OS home (#62804) (thanks @stainlu) · openclaw/openclaw@ecfaf64 fix: flush creds queue before reconnect socket open (#67464) (thanks … · openclaw/openclaw@405c63f fix: strip standalone <function> tool call tags from visible text (#6… · openclaw/openclaw@78df859 fix(agents): preserve cli session metadata before transcript persist … · openclaw/openclaw@898fd04 docs(changelog): move cli transcript entry · openclaw/openclaw@c1817c6 fix(agents): normalize cli transcript api field · openclaw/openclaw@3a3fae0 docs(changelog): note cli transcript persistence · openclaw/openclaw@6c343f1 fix(agents): persist cli transcript turns · openclaw/openclaw@b8ef507 fix(msteams): harden security-sensitive flows (#65841) · openclaw/openclaw@c56b56e [Dashboard] Fix exec approval modal overflow for long command content… · openclaw/openclaw@053c5b0 Docs: remove QA changelog entry · openclaw/openclaw@7fd5771 QA: fix private runtime source loading (#67428) · openclaw/openclaw@d5933af docs(gateway): correct protocol.md schema path, hello-ok example, aut… · openclaw/openclaw@489404d CI: pin Node 22 runners to 22.18.0 · openclaw/openclaw@4ffa621 models.authStatus: normalize provider ids + tighten env-backed escape… · openclaw/openclaw@f2fdb9d Update CHANGELOG.md · openclaw/openclaw@7694a92 test(parallels): clean up npm update guard jobs · openclaw/openclaw@045ea7b Plugins: prefer scanDir override paths · openclaw/openclaw@b2974da fix(dreaming): default storage.mode to "separate" so phase blocks sto… · openclaw/openclaw@8c392f0 fix(memory-core): skip dreaming transcript ingestion via session stor… · openclaw/openclaw@a1b01f0 fix: dedupe replayed exec.finished node events (#67281) · openclaw/openclaw@5dcf526
fix(agents): guard vanished workspaces · openclaw/openclaw@1b10739
TurboTheTurt · 2026-06-01 · via Recent Commits to openclaw:main

@@ -1,7 +1,8 @@

1+

import { createHash } from "node:crypto";

12

import fs from "node:fs/promises";

23

import os from "node:os";

34

import path from "node:path";

4-

import { describe, expect, it, vi } from "vitest";

5+

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

56

import { makeTempWorkspace, writeWorkspaceFile } from "../test-helpers/workspace.js";

67

import {

78

DEFAULT_AGENTS_FILENAME,

@@ -19,9 +20,26 @@ import {

1920

reconcileWorkspaceBootstrapCompletion,

2021

resolveWorkspaceBootstrapStatus,

2122

resolveDefaultAgentWorkspaceDir,

23+

resolveWorkspaceAttestationPath,

24+

WORKSPACE_VANISHED_ERROR_CODE,

2225

type WorkspaceBootstrapFile,

2326

} from "./workspace.js";

242728+

let testStateDir: string | undefined;

29+30+

beforeEach(async () => {

31+

testStateDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-workspace-state-"));

32+

vi.stubEnv("OPENCLAW_STATE_DIR", testStateDir);

33+

});

34+35+

afterEach(async () => {

36+

vi.unstubAllEnvs();

37+

if (testStateDir) {

38+

await fs.rm(testStateDir, { recursive: true, force: true });

39+

testStateDir = undefined;

40+

}

41+

});

42+2543

describe("resolveDefaultAgentWorkspaceDir", () => {

2644

it("uses OPENCLAW_HOME for default workspace resolution", () => {

2745

const dir = resolveDefaultAgentWorkspaceDir({

@@ -68,6 +86,17 @@ async function expectPathMissing(filePath: string): Promise<void> {

6886

await expect(fs.access(filePath)).rejects.toHaveProperty("code", "ENOENT");

6987

}

708889+

async function expectWorkspaceVanished(

90+

action: Promise<unknown>,

91+

expected?: { attestationPath?: string },

92+

): Promise<void> {

93+

await expect(action).rejects.toMatchObject({

94+

code: WORKSPACE_VANISHED_ERROR_CODE,

95+

name: "WorkspaceVanishedError",

96+

...expected,

97+

});

98+

}

99+71100

async function expectCompletedWithoutBootstrap(dir: string) {

72101

await expect(fs.access(path.join(dir, DEFAULT_IDENTITY_FILENAME))).resolves.toBeUndefined();

73102

await expectPathMissing(path.join(dir, DEFAULT_BOOTSTRAP_FILENAME));

@@ -95,6 +124,289 @@ describe("ensureAgentWorkspace", () => {

95124

expect((await readWorkspaceState(tempDir)).setupCompletedAt).toBeUndefined();

96125

});

97126127+

it("refuses to re-seed a recently attested workspace after the directory disappears", async () => {

128+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

129+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

130+

await expect(fs.access(resolveWorkspaceAttestationPath(tempDir))).resolves.toBeUndefined();

131+132+

await fs.rm(tempDir, { recursive: true, force: true });

133+134+

await expectWorkspaceVanished(

135+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

136+

);

137+

await expectPathMissing(tempDir);

138+

});

139+140+

it("refuses to re-seed a recently attested workspace after its contents are wiped", async () => {

141+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

142+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

143+144+

await fs.rm(tempDir, { recursive: true, force: true });

145+

await fs.mkdir(tempDir, { recursive: true });

146+147+

await expectWorkspaceVanished(

148+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

149+

);

150+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

151+

await expectPathMissing(path.join(tempDir, ...WORKSPACE_STATE_PATH_SEGMENTS));

152+

});

153+154+

it("refuses to re-seed a recently attested workspace after only generated remnants survive", async () => {

155+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

156+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

157+

const generatedAgents = await fs.readFile(path.join(tempDir, DEFAULT_AGENTS_FILENAME), "utf-8");

158+159+

await fs.rm(tempDir, { recursive: true, force: true });

160+

await fs.mkdir(tempDir, { recursive: true });

161+

await fs.writeFile(path.join(tempDir, DEFAULT_AGENTS_FILENAME), generatedAgents);

162+163+

await expectWorkspaceVanished(

164+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

165+

);

166+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

167+

await expectPathMissing(path.join(tempDir, ...WORKSPACE_STATE_PATH_SEGMENTS));

168+

});

169+170+

it("refuses to re-seed a recently attested workspace after only generated git metadata survives", async () => {

171+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

172+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

173+174+

await fs.rm(tempDir, { recursive: true, force: true });

175+

await fs.mkdir(path.join(tempDir, ".git"), { recursive: true });

176+

await fs.mkdir(path.join(tempDir, ".openclaw"), { recursive: true });

177+178+

await expectWorkspaceVanished(

179+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

180+

);

181+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

182+

});

183+184+

it("refuses to accept old generated bootstrap files recorded by the attestation marker", async () => {

185+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

186+

const oldGeneratedAgents = "old generated agents\n";

187+

await fs.writeFile(path.join(tempDir, DEFAULT_AGENTS_FILENAME), oldGeneratedAgents);

188+

const attestationPath = resolveWorkspaceAttestationPath(tempDir);

189+

await fs.mkdir(path.dirname(attestationPath), { recursive: true });

190+

await fs.writeFile(

191+

attestationPath,

192+

[

193+

"openclaw-workspace-attestation:v1",

194+

new Date().toISOString(),

195+

`generated:${DEFAULT_AGENTS_FILENAME}:${createHash("sha256").update(oldGeneratedAgents).digest("hex")}`,

196+

"",

197+

].join("\n"),

198+

);

199+200+

await expectWorkspaceVanished(

201+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

202+

);

203+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

204+

});

205+206+

it("refuses a recently attested workspace when generated state and only one generated file survive", async () => {

207+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

208+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

209+

const generatedAgents = await fs.readFile(path.join(tempDir, DEFAULT_AGENTS_FILENAME), "utf-8");

210+

const state = await fs.readFile(path.join(tempDir, ...WORKSPACE_STATE_PATH_SEGMENTS), "utf-8");

211+212+

await fs.rm(tempDir, { recursive: true, force: true });

213+

await fs.mkdir(path.join(tempDir, WORKSPACE_STATE_PATH_SEGMENTS[0]), { recursive: true });

214+

await fs.writeFile(path.join(tempDir, DEFAULT_AGENTS_FILENAME), generatedAgents);

215+

await fs.writeFile(path.join(tempDir, ...WORKSPACE_STATE_PATH_SEGMENTS), state);

216+217+

await expectWorkspaceVanished(

218+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

219+

);

220+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

221+

});

222+223+

it("accepts a recently attested workspace when customized AGENTS.md survives", async () => {

224+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

225+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

226+

await fs.writeFile(path.join(tempDir, DEFAULT_AGENTS_FILENAME), "custom instructions\n");

227+

await fs.rm(path.join(tempDir, ...WORKSPACE_STATE_PATH_SEGMENTS), { force: true });

228+

await fs.rm(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME), { force: true });

229+230+

await expect(

231+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

232+

).resolves.toMatchObject({ dir: tempDir });

233+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

234+

});

235+236+

it("accepts a recently attested workspace when only custom skills survive", async () => {

237+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

238+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

239+240+

await fs.rm(tempDir, { recursive: true, force: true });

241+

await fs.mkdir(path.join(tempDir, "skills", "local-skill"), { recursive: true });

242+

await fs.writeFile(path.join(tempDir, "skills", "local-skill", "SKILL.md"), "---\n");

243+244+

await expect(

245+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

246+

).resolves.toMatchObject({ dir: tempDir });

247+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

248+

expect((await readWorkspaceState(tempDir)).setupCompletedAt).toMatch(/\d{4}-\d{2}-\d{2}T/);

249+

});

250+251+

it("refuses a recently attested workspace when only non-skill skills leftovers survive", async () => {

252+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

253+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

254+255+

await fs.rm(tempDir, { recursive: true, force: true });

256+

await fs.mkdir(path.join(tempDir, "skills"), { recursive: true });

257+

await fs.writeFile(path.join(tempDir, "skills", ".DS_Store"), "");

258+259+

await expectWorkspaceVanished(

260+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

261+

);

262+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

263+

});

264+265+

it("refuses to recreate a skip-bootstrap workspace after the directory disappears", async () => {

266+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

267+

await fs.writeFile(path.join(tempDir, "seed.txt"), "preseeded\n");

268+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: false });

269+270+

await fs.rm(tempDir, { recursive: true, force: true });

271+272+

await expectWorkspaceVanished(

273+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: false }),

274+

);

275+

await expectPathMissing(tempDir);

276+

});

277+278+

it("refuses to accept an empty skip-bootstrap workspace after contents are wiped", async () => {

279+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

280+

await fs.writeFile(path.join(tempDir, "seed.txt"), "preseeded\n");

281+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: false });

282+283+

await fs.rm(tempDir, { recursive: true, force: true });

284+

await fs.mkdir(tempDir, { recursive: true });

285+286+

await expectWorkspaceVanished(

287+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: false }),

288+

);

289+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

290+

});

291+292+

it("refuses to accept a wiped skip-bootstrap workspace with only metadata leftovers", async () => {

293+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

294+

await fs.writeFile(path.join(tempDir, "seed.txt"), "preseeded\n");

295+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: false });

296+297+

await fs.rm(tempDir, { recursive: true, force: true });

298+

await fs.mkdir(path.join(tempDir, ".openclaw"), { recursive: true });

299+

await fs.mkdir(path.join(tempDir, "skills"), { recursive: true });

300+

await fs.writeFile(path.join(tempDir, ".DS_Store"), "");

301+302+

await expectWorkspaceVanished(

303+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: false }),

304+

);

305+

await expectPathMissing(path.join(tempDir, DEFAULT_BOOTSTRAP_FILENAME));

306+

});

307+308+

it("allows repeated skip-bootstrap setup for an intentionally empty workspace", async () => {

309+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

310+311+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: false });

312+

await expect(

313+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: false }),

314+

).resolves.toMatchObject({ dir: tempDir });

315+

});

316+317+

it("allows a brand new workspace when the only attestation marker is stale", async () => {

318+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

319+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

320+

await fs.rm(tempDir, { recursive: true, force: true });

321+

const staleDate = new Date(Date.now() - 25 * 60 * 60 * 1000);

322+

await fs.utimes(resolveWorkspaceAttestationPath(tempDir), staleDate, staleDate);

323+324+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

325+326+

await expectBootstrapSeeded(tempDir);

327+

});

328+329+

it("does not overwrite a sibling file that is not an OpenClaw attestation marker", async () => {

330+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

331+

const attestationPath = `${tempDir}.attested`;

332+

const siblingContent = "external attestation data\n";

333+

await fs.writeFile(attestationPath, siblingContent);

334+335+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

336+337+

await expectBootstrapSeeded(tempDir);

338+

expect(await fs.readFile(attestationPath, "utf-8")).toBe(siblingContent);

339+

});

340+341+

it("does not read or overwrite a large sibling file at the marker path", async () => {

342+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

343+

const attestationPath = `${tempDir}.attested`;

344+

const siblingContent = "x".repeat(1024);

345+

await fs.writeFile(attestationPath, siblingContent);

346+347+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

348+349+

await expectBootstrapSeeded(tempDir);

350+

expect(await fs.readFile(attestationPath, "utf-8")).toBe(siblingContent);

351+

});

352+353+

it.skipIf(process.platform === "win32")(

354+

"refuses to re-seed when a recent owned marker becomes unreadable",

355+

async () => {

356+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

357+

const attestationPath = resolveWorkspaceAttestationPath(tempDir);

358+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

359+

await fs.chmod(attestationPath, 0o000);

360+

await fs.rm(tempDir, { recursive: true, force: true });

361+362+

try {

363+

await expectWorkspaceVanished(

364+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

365+

);

366+

} finally {

367+

await fs.chmod(attestationPath, 0o600);

368+

}

369+

},

370+

);

371+372+

it.skipIf(process.platform === "win32")(

373+

"refuses to re-seed when the state marker directory is unreadable",

374+

async () => {

375+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

376+

const attestationDir = path.dirname(resolveWorkspaceAttestationPath(tempDir));

377+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

378+

await fs.chmod(attestationDir, 0o000);

379+

await fs.rm(tempDir, { recursive: true, force: true });

380+381+

try {

382+

await expectWorkspaceVanished(

383+

ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true }),

384+

);

385+

} finally {

386+

await fs.chmod(attestationDir, 0o700);

387+

}

388+

},

389+

);

390+391+

it.skipIf(process.platform === "win32")(

392+

"ignores symlinked attestation markers without overwriting the target",

393+

async () => {

394+

const tempDir = await makeTempWorkspace("openclaw-workspace-");

395+

const attestationPath = resolveWorkspaceAttestationPath(tempDir);

396+

const symlinkTargetPath = `${attestationPath}-target`;

397+

const targetContent = "outside-marker\n";

398+

await fs.mkdir(path.dirname(attestationPath), { recursive: true });

399+

await fs.writeFile(symlinkTargetPath, targetContent);

400+

await fs.symlink(symlinkTargetPath, attestationPath);

401+402+

await ensureAgentWorkspace({ dir: tempDir, ensureBootstrapFiles: true });

403+404+

await expectBootstrapSeeded(tempDir);

405+

expect(await fs.readFile(symlinkTargetPath, "utf-8")).toBe(targetContent);

406+

expect((await fs.lstat(attestationPath)).isSymbolicLink()).toBe(true);

407+

},

408+

);

409+98410

it("recovers partial initialization by creating BOOTSTRAP.md when marker is missing", async () => {

99411

const tempDir = await makeTempWorkspace("openclaw-workspace-");

100412

await writeWorkspaceFile({ dir: tempDir, name: DEFAULT_AGENTS_FILENAME, content: "existing" });