@2en/clawly-plugins 1.30.0-beta.2 → 1.30.0-beta.4

package/tools/clawly-send-file.test.ts

@@ -0,0 +1,400 @@
+import {afterAll, beforeEach, describe, expect, mock, test} from 'bun:test'
+import fsp from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import type {PluginApi} from '../types'
+import {registerSendFileTool} from './clawly-send-file'
+
+// ── Mocks ────────────────────────────────────────────────────────
+
+let mockInjectParams: {sessionKey: string; message: string} | null = null
+let mockFileTypeFromBuffer: (buf: Uint8Array) => Promise<{mime: string; ext: string} | undefined>
+let mockFileTypeFromFile: (p: string) => Promise<{mime: string; ext: string} | undefined>
+
+mock.module('../gateway/inject', () => ({
+  resolveSessionKey: async () => 'agent:clawly:main',
+  injectAssistantMessage: async (params: {sessionKey: string; message: string}) => {
+    mockInjectParams = params
+    return {ok: true, messageId: 'msg-123'}
+  },
+}))
+
+mock.module('file-type', () => ({
+  fileTypeFromBuffer: async (buf: Uint8Array) => mockFileTypeFromBuffer(buf),
+  fileTypeFromFile: async (p: string) => mockFileTypeFromFile(p),
+}))
+
+// ── Helpers ──────────────────────────────────────────────────────
+
+type ToolExecute = (
+  toolCallId: string,
+  params: Record<string, unknown>,
+) => Promise<{content: {type: string; text: string}[]}>
+
+function createMockApi(stateDir?: string): {
+  api: PluginApi
+  logs: {level: string; msg: string}[]
+  execute: ToolExecute
+} {
+  const logs: {level: string; msg: string}[] = []
+  let registeredExecute: ToolExecute | null = null
+  const dir = stateDir ?? path.join(os.tmpdir(), `clawly-send-file-test-${Date.now()}`)
+
+  const api = {
+    id: 'test',
+    name: 'test',
+    logger: {
+      info: (msg: string) => logs.push({level: 'info', msg}),
+      warn: (msg: string) => logs.push({level: 'warn', msg}),
+      error: (msg: string) => logs.push({level: 'error', msg}),
+    },
+    runtime: {
+      state: {
+        resolveStateDir: () => dir,
+      },
+    },
+    registerTool: (tool: {execute: ToolExecute}) => {
+      registeredExecute = tool.execute
+    },
+  } as unknown as PluginApi
+
+  registerSendFileTool(api)
+
+  return {api, logs, execute: registeredExecute!}
+}
+
+function parseResult(res: {content: {type: string; text: string}[]}): Record<string, unknown> {
+  return JSON.parse(res.content[0].text)
+}
+
+// Minimal PNG magic bytes (first 8 bytes)
+const PNG_BYTES = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])
+
+let originalFetch: typeof globalThis.fetch
+
+beforeEach(() => {
+  mockInjectParams = null
+  mockFileTypeFromBuffer = async () => ({mime: 'image/png', ext: 'png'})
+  mockFileTypeFromFile = async () => ({mime: 'image/png', ext: 'png'})
+
+  originalFetch = globalThis.fetch
+  globalThis.fetch = (async (url: string, init?: RequestInit) => {
+    const body = new ReadableStream({
+      start(controller) {
+        controller.enqueue(PNG_BYTES)
+        controller.close()
+      },
+    })
+    return new Response(body, {
+      status: 200,
+      headers: {'content-length': String(PNG_BYTES.length)},
+    })
+  }) as typeof fetch
+})
+
+afterAll(() => {
+  globalThis.fetch = originalFetch
+})
+
+// ── Tests ────────────────────────────────────────────────────────
+
+describe('clawly_send_file', () => {
+  describe('validation', () => {
+    test('returns error for empty source', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: ''}))
+      expect(res.error).toBe('source is required')
+    })
+
+    test('returns error for missing source', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {}))
+      expect(res.error).toBe('source is required')
+    })
+
+    test('returns error for empty array source', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: []}))
+      expect(res.error).toBe('source is required')
+    })
+
+    test('returns error for array of empty strings', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: ['', '  ', '']}))
+      expect(res.error).toBe('source is required')
+    })
+  })
+
+  describe('URL source', () => {
+    test('downloads URL and injects FILE message', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: 'https://example.com/image.png'}))
+
+      expect(res.sent).toBe(true)
+      expect(res.count).toBe(1)
+      expect(mockInjectParams).not.toBeNull()
+      expect(mockInjectParams!.message).toContain('FILE:')
+      expect(mockInjectParams!.message).toMatch(/FILE:\/.*\/[a-f0-9]+\.png\?filename=image\.png/)
+    })
+
+    test('rejects URL with executable extension', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: 'https://example.com/script.sh'}))
+
+      expect(res.error).toContain('executable extension')
+    })
+
+    test('rejects downloaded executable by MIME', async () => {
+      mockFileTypeFromBuffer = async () => ({
+        mime: 'application/x-elf',
+        ext: 'elf',
+      })
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: 'https://example.com/binary'}))
+
+      expect(res.error).toContain('executable')
+    })
+
+    test('uses caption when provided', async () => {
+      const {execute} = createMockApi()
+      await execute('tc-1', {
+        source: 'https://example.com/photo.jpg',
+        caption: 'Check this out',
+      })
+
+      expect(mockInjectParams!.message).toStartWith('Check this out')
+      expect(mockInjectParams!.message).toContain('FILE:')
+    })
+  })
+
+  describe('local file source', () => {
+    test('accepts file under /tmp', async () => {
+      const tmpFile = path.join('/tmp', `clawly-send-file-test-${Date.now()}.txt`)
+      await fsp.writeFile(tmpFile, 'hello')
+      try {
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: tmpFile}))
+
+        expect(res.sent).toBe(true)
+        expect(res.count).toBe(1)
+        expect(mockInjectParams!.message).toContain('FILE:')
+      } finally {
+        await fsp.unlink(tmpFile).catch(() => {})
+      }
+    })
+
+    test('accepts file under $HOME', async () => {
+      const homeFile = path.join(os.homedir(), `clawly-send-file-test-${Date.now()}.txt`)
+      await fsp.writeFile(homeFile, 'hello')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: homeFile}))
+
+        expect(res.sent).toBe(true)
+        expect(res.count).toBe(1)
+      } finally {
+        await fsp.unlink(homeFile).catch(() => {})
+      }
+    })
+
+    test('accepts tilde-expanded path', async () => {
+      const homeFile = path.join(os.homedir(), `clawly-send-file-test-${Date.now()}.txt`)
+      await fsp.writeFile(homeFile, 'hello')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: `~/${path.basename(homeFile)}`}))
+
+        expect(res.sent).toBe(true)
+      } finally {
+        await fsp.unlink(homeFile).catch(() => {})
+      }
+    })
+
+    test('rejects file outside $HOME and /tmp', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: '/etc/hosts'}))
+
+      expect(res.error).toContain('$HOME or /tmp')
+    })
+
+    test('rejects dot files', async () => {
+      const dotFile = path.join('/tmp', `.clawly-send-file-test-${Date.now()}`)
+      await fsp.writeFile(dotFile, 'secret')
+      try {
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: dotFile}))
+
+        expect(res.error).toContain('dot files')
+      } finally {
+        await fsp.unlink(dotFile).catch(() => {})
+      }
+    })
+
+    test('rejects path with dot component (e.g. .openclaw)', async () => {
+      const inDotDir = path.join('/tmp', '.openclaw', `test-${Date.now()}.txt`)
+      await fsp.mkdir(path.dirname(inDotDir), {recursive: true})
+      await fsp.writeFile(inDotDir, 'config')
+      try {
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: inDotDir}))
+
+        expect(res.error).toContain('dot files')
+      } finally {
+        await fsp.unlink(inDotDir).catch(() => {})
+        await fsp.rmdir(path.dirname(inDotDir)).catch(() => {})
+      }
+    })
+
+    test('rejects executable by extension', async () => {
+      const shFile = path.join('/tmp', `clawly-send-file-test-${Date.now()}.sh`)
+      await fsp.writeFile(shFile, '#!/bin/bash\necho hi')
+      try {
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: shFile}))
+
+        expect(res.error).toContain('executable')
+      } finally {
+        await fsp.unlink(shFile).catch(() => {})
+      }
+    })
+
+    test('rejects executable by MIME', async () => {
+      const binFile = path.join('/tmp', `clawly-send-file-test-${Date.now()}.bin`)
+      await fsp.writeFile(binFile, '\x7fELF')
+      try {
+        mockFileTypeFromFile = async () => ({
+          mime: 'application/x-elf',
+          ext: 'elf',
+        })
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: binFile}))
+
+        expect(res.error).toContain('executable')
+      } finally {
+        await fsp.unlink(binFile).catch(() => {})
+      }
+    })
+
+    test('returns error for non-existent file', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: '/tmp/nonexistent-file-12345.txt'}))
+
+      expect(res.error).toContain('file not found')
+    })
+  })
+
+  describe('state dir restriction', () => {
+    test('rejects file directly under state dir', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const stateFile = path.join(stateDir, 'config.json')
+      await fsp.mkdir(stateDir, {recursive: true})
+      await fsp.writeFile(stateFile, '{}')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'application/json', ext: 'json'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: stateFile}))
+        expect(res.error).toContain('state directory')
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+
+    test('rejects file in non-allowed state subdir', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const secretFile = path.join(stateDir, 'agents', 'secret.txt')
+      await fsp.mkdir(path.dirname(secretFile), {recursive: true})
+      await fsp.writeFile(secretFile, 'secret')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: secretFile}))
+        expect(res.error).toContain('state directory')
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+
+    test('allows file under state dir clawly/', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const allowedFile = path.join(stateDir, 'clawly', 'data.txt')
+      await fsp.mkdir(path.dirname(allowedFile), {recursive: true})
+      await fsp.writeFile(allowedFile, 'ok')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: allowedFile}))
+        expect(res.sent).toBe(true)
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+
+    test('allows file under state dir canvas/', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const allowedFile = path.join(stateDir, 'canvas', 'sketch.png')
+      await fsp.mkdir(path.dirname(allowedFile), {recursive: true})
+      await fsp.writeFile(allowedFile, 'ok')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'image/png', ext: 'png'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: allowedFile}))
+        expect(res.sent).toBe(true)
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+
+    test('allows file under state dir memory/', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const allowedFile = path.join(stateDir, 'memory', 'note.md')
+      await fsp.mkdir(path.dirname(allowedFile), {recursive: true})
+      await fsp.writeFile(allowedFile, 'ok')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: allowedFile}))
+        expect(res.sent).toBe(true)
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+  })
+
+  describe('array source', () => {
+    test('processes multiple sources', async () => {
+      const tmp1 = path.join('/tmp', `clawly-send-file-a-${Date.now()}.txt`)
+      const tmp2 = path.join('/tmp', `clawly-send-file-b-${Date.now()}.txt`)
+      await fsp.writeFile(tmp1, 'a')
+      await fsp.writeFile(tmp2, 'b')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: [tmp1, tmp2]}))
+
+        expect(res.sent).toBe(true)
+        expect(res.count).toBe(2)
+        expect(mockInjectParams!.message.split('FILE:').length - 1).toBe(2)
+      } finally {
+        await fsp.unlink(tmp1).catch(() => {})
+        await fsp.unlink(tmp2).catch(() => {})
+      }
+    })
+
+    test('filters empty strings from array', async () => {
+      const tmpFile = path.join('/tmp', `clawly-send-file-${Date.now()}.txt`)
+      await fsp.writeFile(tmpFile, 'x')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: ['', tmpFile, '  ', tmpFile]}))
+
+        expect(res.sent).toBe(true)
+        expect(res.count).toBe(2)
+      } finally {
+        await fsp.unlink(tmpFile).catch(() => {})
+      }
+    })
+  })
+})