Include full contents of all nested repositories

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openclaw/test/scripts/check-channel-agnostic-boundaries.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, it } from "vitest";
+import {
+  findChannelAgnosticBoundaryViolations,
+  findAcpUserFacingChannelNameViolations,
+  findChannelCoreReverseDependencyViolations,
+  findSystemMarkLiteralViolations,
+} from "../../scripts/check-channel-agnostic-boundaries.mjs";
+
+describe("check-channel-agnostic-boundaries", () => {
+  it("flags direct channel module imports", () => {
+    const source = `
+      import { getThreadBindingManager } from "../discord/monitor/thread-bindings.js";
+      const x = 1;
+    `;
+    expect(findChannelAgnosticBoundaryViolations(source)).toEqual([
+      {
+        line: 2,
+        reason: 'imports channel module "../discord/monitor/thread-bindings.js"',
+      },
+    ]);
+  });
+
+  it("flags channel config path access", () => {
+    const source = `
+      const x = cfg.channels.discord?.threadBindings?.enabled;
+    `;
+    expect(findChannelAgnosticBoundaryViolations(source)).toEqual([
+      {
+        line: 2,
+        reason: 'references config path "channels.discord"',
+      },
+    ]);
+  });
+
+  it("flags channel-literal comparisons", () => {
+    const source = `
+      if (channel === "discord") {
+        return true;
+      }
+    `;
+    expect(findChannelAgnosticBoundaryViolations(source)).toEqual([
+      {
+        line: 2,
+        reason: 'compares with channel id literal (channel === "discord")',
+      },
+    ]);
+  });
+
+  it("flags object literals with explicit channel ids", () => {
+    const source = `
+      const payload = { channel: "telegram" };
+    `;
+    expect(findChannelAgnosticBoundaryViolations(source)).toEqual([
+      {
+        line: 2,
+        reason: 'assigns channel id literal to "channel" ("telegram")',
+      },
+    ]);
+  });
+
+  it("ignores non-channel literals and unrelated text", () => {
+    const source = `
+      const msg = "discord";
+      const payload = { mode: "persistent" };
+      const x = cfg.session.threadBindings?.enabled;
+    `;
+    expect(findChannelAgnosticBoundaryViolations(source)).toEqual([]);
+  });
+
+  it("reverse-deps mode flags channel module re-exports", () => {
+    const source = `
+      export { resolveThreadBindingIntroText } from "../discord/monitor/thread-bindings.messages.js";
+    `;
+    expect(findChannelCoreReverseDependencyViolations(source)).toEqual([
+      {
+        line: 2,
+        reason: 're-exports channel module "../discord/monitor/thread-bindings.messages.js"',
+      },
+    ]);
+  });
+
+  it("reverse-deps mode ignores channel literals when no imports are present", () => {
+    const source = `
+      const channel = "discord";
+      const x = cfg.channels.discord?.threadBindings?.enabled;
+    `;
+    expect(findChannelCoreReverseDependencyViolations(source)).toEqual([]);
+  });
+
+  it("user-facing text mode flags channel names in string literals", () => {
+    const source = `
+      const message = "Bind a Discord thread first.";
+    `;
+    expect(findAcpUserFacingChannelNameViolations(source)).toEqual([
+      {
+        line: 2,
+        reason: 'user-facing text references channel name ("Bind a Discord thread first.")',
+      },
+    ]);
+  });
+
+  it("user-facing text mode ignores channel names in import specifiers", () => {
+    const source = `
+      import { x } from "../discord/monitor/thread-bindings.js";
+    `;
+    expect(findAcpUserFacingChannelNameViolations(source)).toEqual([]);
+  });
+
+  it("system-mark guard flags hardcoded gear literals", () => {
+    const source = `
+      const line = "⚙️ Thread bindings enabled.";
+    `;
+    expect(findSystemMarkLiteralViolations(source)).toEqual([
+      {
+        line: 2,
+        reason: 'hardcoded system mark literal ("⚙️ Thread bindings enabled.")',
+      },
+    ]);
+  });
+
+  it("system-mark guard ignores module import specifiers", () => {
+    const source = `
+      import { x } from "../infra/system-message.js";
+    `;
+    expect(findSystemMarkLiteralViolations(source)).toEqual([]);
+  });
+});

openclaw/test/scripts/check-no-random-messaging-tmp.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { findMessagingTmpdirCallLines } from "../../scripts/check-no-random-messaging-tmp.mjs";
+
+describe("check-no-random-messaging-tmp", () => {
+  it("finds os.tmpdir calls imported from node:os", () => {
+    const source = `
+      import os from "node:os";
+      const dir = os.tmpdir();
+    `;
+    expect(findMessagingTmpdirCallLines(source)).toEqual([3]);
+  });
+
+  it("finds tmpdir named import calls from node:os", () => {
+    const source = `
+      import { tmpdir } from "node:os";
+      const dir = tmpdir();
+    `;
+    expect(findMessagingTmpdirCallLines(source)).toEqual([3]);
+  });
+
+  it("finds tmpdir calls imported from os", () => {
+    const source = `
+      import os from "os";
+      const dir = os.tmpdir();
+    `;
+    expect(findMessagingTmpdirCallLines(source)).toEqual([3]);
+  });
+
+  it("ignores mentions in comments and strings", () => {
+    const source = `
+      // os.tmpdir()
+      const text = "tmpdir()";
+    `;
+    expect(findMessagingTmpdirCallLines(source)).toEqual([]);
+  });
+
+  it("ignores tmpdir symbols that are not imported from node:os", () => {
+    const source = `
+      const tmpdir = () => "/tmp";
+      const dir = tmpdir();
+    `;
+    expect(findMessagingTmpdirCallLines(source)).toEqual([]);
+  });
+});

openclaw/test/scripts/check-no-raw-window-open.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import { findRawWindowOpenLines } from "../../scripts/check-no-raw-window-open.mjs";
+
+describe("check-no-raw-window-open", () => {
+  it("finds direct window.open calls", () => {
+    const source = `
+      function openDocs() {
+        window.open("https://docs.openclaw.ai");
+      }
+    `;
+    expect(findRawWindowOpenLines(source)).toEqual([3]);
+  });
+
+  it("finds globalThis.open calls", () => {
+    const source = `
+      function openDocs() {
+        globalThis.open("https://docs.openclaw.ai");
+      }
+    `;
+    expect(findRawWindowOpenLines(source)).toEqual([3]);
+  });
+
+  it("ignores mentions in strings and comments", () => {
+    const source = `
+      // window.open("https://example.com")
+      const text = "window.open('https://example.com')";
+    `;
+    expect(findRawWindowOpenLines(source)).toEqual([]);
+  });
+
+  it("handles parenthesized and asserted window references", () => {
+    const source = `
+      const openRef = (window as Window).open;
+      openRef("https://example.com");
+      (window as Window).open("https://example.com");
+    `;
+    expect(findRawWindowOpenLines(source)).toEqual([4]);
+  });
+});

openclaw/test/scripts/ios-team-id.test.ts

@@ -0,0 +1,231 @@
+import { execFileSync } from "node:child_process";
+import { chmodSync } from "node:fs";
+import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+const SCRIPT = path.join(process.cwd(), "scripts", "ios-team-id.sh");
+
+async function writeExecutable(filePath: string, body: string): Promise<void> {
+  await writeFile(filePath, body, "utf8");
+  chmodSync(filePath, 0o755);
+}
+
+function runScript(
+  homeDir: string,
+  extraEnv: Record<string, string> = {},
+): {
+  ok: boolean;
+  stdout: string;
+  stderr: string;
+} {
+  const binDir = path.join(homeDir, "bin");
+  const env = {
+    ...process.env,
+    HOME: homeDir,
+    PATH: `${binDir}:${process.env.PATH ?? ""}`,
+    ...extraEnv,
+  };
+  try {
+    const stdout = execFileSync("bash", [SCRIPT], {
+      env,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return { ok: true, stdout: stdout.trim(), stderr: "" };
+  } catch (error) {
+    const e = error as {
+      stdout?: string | Buffer;
+      stderr?: string | Buffer;
+    };
+    const stdout = typeof e.stdout === "string" ? e.stdout : (e.stdout?.toString("utf8") ?? "");
+    const stderr = typeof e.stderr === "string" ? e.stderr : (e.stderr?.toString("utf8") ?? "");
+    return { ok: false, stdout: stdout.trim(), stderr: stderr.trim() };
+  }
+}
+
+describe("scripts/ios-team-id.sh", () => {
+  it("falls back to Xcode-managed provisioning profiles when preference teams are empty", async () => {
+    const homeDir = await mkdtemp(path.join(os.tmpdir(), "openclaw-ios-team-id-"));
+    const binDir = path.join(homeDir, "bin");
+    await mkdir(binDir, { recursive: true });
+    await mkdir(path.join(homeDir, "Library", "Preferences"), { recursive: true });
+    await mkdir(path.join(homeDir, "Library", "MobileDevice", "Provisioning Profiles"), {
+      recursive: true,
+    });
+    await writeFile(path.join(homeDir, "Library", "Preferences", "com.apple.dt.Xcode.plist"), "");
+    await writeFile(
+      path.join(homeDir, "Library", "MobileDevice", "Provisioning Profiles", "one.mobileprovision"),
+      "stub",
+    );
+
+    await writeExecutable(
+      path.join(binDir, "plutil"),
+      `#!/usr/bin/env bash
+echo '{}'`,
+    );
+    await writeExecutable(
+      path.join(binDir, "defaults"),
+      `#!/usr/bin/env bash
+if [[ "$3" == "DVTDeveloperAccountManagerAppleIDLists" ]]; then
+  echo '(identifier = "dev@example.com";)'
+  exit 0
+fi
+exit 0`,
+    );
+    await writeExecutable(
+      path.join(binDir, "security"),
+      `#!/usr/bin/env bash
+if [[ "$1" == "cms" && "$2" == "-D" ]]; then
+  cat <<'PLIST'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>TeamIdentifier</key>
+  <array>
+    <string>ABCDE12345</string>
+  </array>
+</dict>
+</plist>
+PLIST
+  exit 0
+fi
+exit 0`,
+    );
+
+    const result = runScript(homeDir);
+    expect(result.ok).toBe(true);
+    expect(result.stdout).toBe("ABCDE12345");
+  });
+
+  it("prints actionable guidance when Xcode account exists but no Team ID is resolvable", async () => {
+    const homeDir = await mkdtemp(path.join(os.tmpdir(), "openclaw-ios-team-id-"));
+    const binDir = path.join(homeDir, "bin");
+    await mkdir(binDir, { recursive: true });
+    await mkdir(path.join(homeDir, "Library", "Preferences"), { recursive: true });
+    await writeFile(path.join(homeDir, "Library", "Preferences", "com.apple.dt.Xcode.plist"), "");
+
+    await writeExecutable(
+      path.join(binDir, "plutil"),
+      `#!/usr/bin/env bash
+echo '{}'`,
+    );
+    await writeExecutable(
+      path.join(binDir, "defaults"),
+      `#!/usr/bin/env bash
+if [[ "$3" == "DVTDeveloperAccountManagerAppleIDLists" ]]; then
+  echo '(identifier = "dev@example.com";)'
+  exit 0
+fi
+echo "Domain/default pair of (com.apple.dt.Xcode, $3) does not exist" >&2
+exit 1`,
+    );
+    await writeExecutable(
+      path.join(binDir, "security"),
+      `#!/usr/bin/env bash
+exit 1`,
+    );
+
+    const result = runScript(homeDir);
+    expect(result.ok).toBe(false);
+    expect(result.stderr).toContain("An Apple account is signed in to Xcode");
+    expect(result.stderr).toContain("IOS_DEVELOPMENT_TEAM");
+  });
+
+  it("honors IOS_PREFERRED_TEAM_ID when multiple profile teams are available", async () => {
+    const homeDir = await mkdtemp(path.join(os.tmpdir(), "openclaw-ios-team-id-"));
+    const binDir = path.join(homeDir, "bin");
+    await mkdir(binDir, { recursive: true });
+    await mkdir(path.join(homeDir, "Library", "Preferences"), { recursive: true });
+    await mkdir(path.join(homeDir, "Library", "MobileDevice", "Provisioning Profiles"), {
+      recursive: true,
+    });
+    await writeFile(path.join(homeDir, "Library", "Preferences", "com.apple.dt.Xcode.plist"), "");
+    await writeFile(
+      path.join(homeDir, "Library", "MobileDevice", "Provisioning Profiles", "one.mobileprovision"),
+      "stub1",
+    );
+    await writeFile(
+      path.join(homeDir, "Library", "MobileDevice", "Provisioning Profiles", "two.mobileprovision"),
+      "stub2",
+    );
+
+    await writeExecutable(
+      path.join(binDir, "plutil"),
+      `#!/usr/bin/env bash
+echo '{}'`,
+    );
+    await writeExecutable(
+      path.join(binDir, "defaults"),
+      `#!/usr/bin/env bash
+if [[ "$3" == "DVTDeveloperAccountManagerAppleIDLists" ]]; then
+  echo '(identifier = "dev@example.com";)'
+  exit 0
+fi
+exit 0`,
+    );
+    await writeExecutable(
+      path.join(binDir, "security"),
+      `#!/usr/bin/env bash
+if [[ "$1" == "cms" && "$2" == "-D" ]]; then
+  if [[ "$4" == *"one.mobileprovision" ]]; then
+    cat <<'PLIST'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>TeamIdentifier</key><array><string>AAAAA11111</string></array></dict></plist>
+PLIST
+    exit 0
+  fi
+  cat <<'PLIST'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>TeamIdentifier</key><array><string>BBBBB22222</string></array></dict></plist>
+PLIST
+  exit 0
+fi
+exit 0`,
+    );
+
+    const result = runScript(homeDir, { IOS_PREFERRED_TEAM_ID: "BBBBB22222" });
+    expect(result.ok).toBe(true);
+    expect(result.stdout).toBe("BBBBB22222");
+  });
+
+  it("matches preferred team IDs even when parser output uses CRLF line endings", async () => {
+    const homeDir = await mkdtemp(path.join(os.tmpdir(), "openclaw-ios-team-id-"));
+    const binDir = path.join(homeDir, "bin");
+    await mkdir(binDir, { recursive: true });
+    await mkdir(path.join(homeDir, "Library", "Preferences"), { recursive: true });
+    await writeFile(path.join(homeDir, "Library", "Preferences", "com.apple.dt.Xcode.plist"), "");
+
+    await writeExecutable(
+      path.join(binDir, "plutil"),
+      `#!/usr/bin/env bash
+echo '{}'`,
+    );
+    await writeExecutable(
+      path.join(binDir, "defaults"),
+      `#!/usr/bin/env bash
+if [[ "$3" == "DVTDeveloperAccountManagerAppleIDLists" ]]; then
+  echo '(identifier = "dev@example.com";)'
+  exit 0
+fi
+exit 0`,
+    );
+    await writeExecutable(
+      path.join(binDir, "fake-python"),
+      `#!/usr/bin/env bash
+printf 'AAAAA11111\\t0\\tAlpha Team\\r\\n'
+printf 'BBBBB22222\\t0\\tBeta Team\\r\\n'`,
+    );
+
+    const result = runScript(homeDir, {
+      IOS_PYTHON_BIN: path.join(binDir, "fake-python"),
+      IOS_PREFERRED_TEAM_ID: "BBBBB22222",
+    });
+    expect(result.ok).toBe(true);
+    expect(result.stdout).toBe("BBBBB22222");
+  });
+});

openclaw/test/scripts/ui.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+import { assertSafeWindowsShellArgs, shouldUseShellForCommand } from "../../scripts/ui.js";
+
+describe("scripts/ui windows spawn behavior", () => {
+  it("enables shell for Windows command launchers that require cmd.exe", () => {
+    expect(
+      shouldUseShellForCommand("C:\\Users\\dev\\AppData\\Local\\pnpm\\pnpm.CMD", "win32"),
+    ).toBe(true);
+    expect(shouldUseShellForCommand("C:\\tools\\pnpm.bat", "win32")).toBe(true);
+  });
+
+  it("does not enable shell for non-shell launchers", () => {
+    expect(shouldUseShellForCommand("C:\\Program Files\\nodejs\\node.exe", "win32")).toBe(false);
+    expect(shouldUseShellForCommand("/usr/local/bin/pnpm", "linux")).toBe(false);
+  });
+
+  it("allows safe forwarded args when shell mode is required on Windows", () => {
+    expect(() =>
+      assertSafeWindowsShellArgs(["run", "build", "--filter", "@openclaw/ui"], "win32"),
+    ).not.toThrow();
+  });
+
+  it("rejects dangerous forwarded args when shell mode is required on Windows", () => {
+    expect(() => assertSafeWindowsShellArgs(["run", "build", "evil&calc"], "win32")).toThrow(
+      /unsafe windows shell argument/i,
+    );
+    expect(() => assertSafeWindowsShellArgs(["run", "build", "%PATH%"], "win32")).toThrow(
+      /unsafe windows shell argument/i,
+    );
+  });
+
+  it("does not reject args on non-windows platforms", () => {
+    expect(() => assertSafeWindowsShellArgs(["contains&metacharacters"], "linux")).not.toThrow();
+  });
+});