mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-03 13:52:09 +03:00
70e46f0471
checkKnownPath() only validated the RESOLVED realpath target against EXPECTED_PARENT_PATHS, never crediting that the candidate path itself was already constructed from a trusted root by getKnownToolPaths(). Version managers that install via symlinks/junctions (nvm-windows and more broadly nvm/asdf/pyenv-style tools) place the shim inside a trusted root but its resolved target lives in a private per-version store outside the allowlist, so it was misreported as symlink_escape (#7753). Fix: trust a candidate location if EITHER its original path OR its resolved target falls within EXPECTED_PARENT_PATHS. Separately, locateCommandCandidate() short-circuited on the FIRST known-path candidate that returned any non-not_found failure reason, without trying the remaining candidates or ever falling back to a real PATH search. A single stray artifact at one guessed Windows install location for claude therefore poisoned detection entirely even when the real binary was resolvable via PATH (#7774). Fix: remember non-fatal known-path failures but keep walking every candidate, and always fall through to the PATH-based search before giving up. Extracted both helpers into a new cliRuntimeKnownPath.ts module (dependency injected, no circular import) to keep cliRuntime.ts under its frozen file-size budget.
68 lines
2.8 KiB
TypeScript
68 lines
2.8 KiB
TypeScript
import { describe, it, before, after } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
|
|
// HOME must be overridden BEFORE importing cliRuntime.ts — the module computes
|
|
// EXPECTED_PARENT_PATHS (the known-path realpath containment check) once at
|
|
// import time from os.homedir().
|
|
const fakeHome = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-7774-home-"));
|
|
const realBinDir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-7774-realbin-"));
|
|
|
|
const savedEnv: Record<string, string | undefined> = {
|
|
HOME: process.env.HOME,
|
|
USERPROFILE: process.env.USERPROFILE,
|
|
PATH: process.env.PATH,
|
|
CLI_CLAUDE_BIN: process.env.CLI_CLAUDE_BIN,
|
|
CLI_EXTRA_PATHS: process.env.CLI_EXTRA_PATHS,
|
|
npm_config_prefix: process.env.npm_config_prefix,
|
|
};
|
|
|
|
process.env.HOME = fakeHome;
|
|
process.env.USERPROFILE = fakeHome;
|
|
delete process.env.CLI_CLAUDE_BIN;
|
|
delete process.env.CLI_EXTRA_PATHS;
|
|
process.env.npm_config_prefix = path.join(fakeHome, "npm-prefix-unused");
|
|
|
|
const { getCliRuntimeStatus, getKnownToolPaths } = await import(
|
|
"../../src/shared/services/cliRuntime.ts"
|
|
);
|
|
|
|
function makeExecutable(filePath: string, content: string) {
|
|
fs.writeFileSync(filePath, content);
|
|
if (process.platform !== "win32") fs.chmodSync(filePath, 0o755);
|
|
}
|
|
|
|
describe("#7774 — known-path short-circuit hides a genuinely runnable Claude binary", () => {
|
|
before(() => {
|
|
const poisonedCandidate = path.join(fakeHome, ".local", "bin", "claude");
|
|
fs.mkdirSync(poisonedCandidate, { recursive: true });
|
|
|
|
const known = getKnownToolPaths("claude");
|
|
assert.ok(known.includes(poisonedCandidate));
|
|
|
|
const realClaude = path.join(realBinDir, "claude");
|
|
makeExecutable(realClaude, "#!/bin/sh\necho '2.1.215 (Claude Code)'\n");
|
|
// Prepend realBinDir rather than replacing PATH outright — locateCommand()
|
|
// spawns `sh`/`where.exe` itself using this same PATH, so the standard
|
|
// system bin dirs (containing `sh`) must stay resolvable too.
|
|
process.env.PATH = [realBinDir, savedEnv.PATH].filter(Boolean).join(path.delimiter);
|
|
});
|
|
|
|
after(() => {
|
|
for (const [key, value] of Object.entries(savedEnv)) {
|
|
if (value === undefined) delete (process.env as Record<string, string | undefined>)[key];
|
|
else process.env[key] = value;
|
|
}
|
|
fs.rmSync(fakeHome, { recursive: true, force: true });
|
|
fs.rmSync(realBinDir, { recursive: true, force: true });
|
|
});
|
|
|
|
it("should still find and report Claude as installed+runnable via PATH fallback", async () => {
|
|
const result = await getCliRuntimeStatus("claude");
|
|
assert.equal(result.installed, true, `expected installed=true, got reason=${result.reason}`);
|
|
assert.equal(result.runnable, true, `expected runnable=true, got reason=${result.reason}`);
|
|
});
|
|
});
|