test(pi-tools): share safeBins e2e setup and teardown

src/agents/pi-tools.safe-bins.e2e.test.ts

@@ -118,17 +118,29 @@ async function createSafeBinsExecTool(params: {
   return { tmpDir, execTool: execTool as ExecTool };
 }
 
-describe("createOpenClawCodingTools safeBins", () => {
+async function withSafeBinsExecTool(
-  it("threads tools.exec.safeBins into exec allowlist checks", async () => {
+  params: Parameters<typeof createSafeBinsExecTool>[0],
+  run: (ctx: Awaited<ReturnType<typeof createSafeBinsExecTool>>) => Promise<void>,
+) {
   if (process.platform === "win32") {
     return;
   }
+  const ctx = await createSafeBinsExecTool(params);
+  try {
+    await run(ctx);
+  } finally {
+    fs.rmSync(ctx.tmpDir, { recursive: true, force: true });
+  }
+}
 
-    const { tmpDir, execTool } = await createSafeBinsExecTool({
+describe("createOpenClawCodingTools safeBins", () => {
+  it("threads tools.exec.safeBins into exec allowlist checks", async () => {
+    await withSafeBinsExecTool(
+      {
         tmpPrefix: "openclaw-safe-bins-",
         safeBins: ["echo"],
-    });
+      },
-
+      async ({ tmpDir, execTool }) => {
         const marker = `safe-bins-${Date.now()}`;
         const result = await withEnvAsync(
           { OPENCLAW_SHELL_ENV_TIMEOUT_MS: "1000" },
@@ -143,19 +155,18 @@ describe("createOpenClawCodingTools safeBins", () => {
         const resultDetails = result.details as { status?: string };
         expect(resultDetails.status).toBe("completed");
         expect(text).toContain(marker);
+      },
+    );
   });
 
   it("does not allow env var expansion to smuggle file args via safeBins", async () => {
-    if (process.platform === "win32") {
+    await withSafeBinsExecTool(
-      return;
+      {
-    }
-
-    const { tmpDir, execTool } = await createSafeBinsExecTool({
         tmpPrefix: "openclaw-safe-bins-expand-",
         safeBins: ["head", "wc"],
         files: [{ name: "secret.txt", contents: "TOP_SECRET\n" }],
-    });
+      },
-
+      async ({ tmpDir, execTool }) => {
         await expect(
           execTool.execute("call1", {
             command: "head $FOO ; wc -l",
@@ -163,19 +174,18 @@ describe("createOpenClawCodingTools safeBins", () => {
             env: { FOO: "secret.txt" },
           }),
         ).rejects.toThrow("exec denied: allowlist miss");
+      },
+    );
   });
 
   it("does not leak file existence from sort output flags", async () => {
-    if (process.platform === "win32") {
+    await withSafeBinsExecTool(
-      return;
+      {
-    }
-
-    const { tmpDir, execTool } = await createSafeBinsExecTool({
         tmpPrefix: "openclaw-safe-bins-oracle-",
         safeBins: ["sort"],
         files: [{ name: "existing.txt", contents: "x\n" }],
-    });
+      },
-
+      async ({ tmpDir, execTool }) => {
         const run = async (command: string) => {
           try {
             const result = await execTool.execute("call-oracle", { command, workdir: tmpDir });
@@ -190,18 +200,17 @@ describe("createOpenClawCodingTools safeBins", () => {
         const existing = await run("sort -o existing.txt");
         const missing = await run("sort -o missing.txt");
         expect(existing).toEqual(missing);
+      },
+    );
   });
 
   it("blocks sort output flags from writing files via safeBins", async () => {
-    if (process.platform === "win32") {
+    await withSafeBinsExecTool(
-      return;
+      {
-    }
-
-    const { tmpDir, execTool } = await createSafeBinsExecTool({
         tmpPrefix: "openclaw-safe-bins-sort-",
         safeBins: ["sort"],
-    });
+      },
-
+      async ({ tmpDir, execTool }) => {
         const cases = [
           { command: "sort -oblocked-short.txt", target: "blocked-short.txt" },
           { command: "sort --output=blocked-long.txt", target: "blocked-long.txt" },
@@ -216,37 +225,35 @@ describe("createOpenClawCodingTools safeBins", () => {
           ).rejects.toThrow("exec denied: allowlist miss");
           expect(fs.existsSync(path.join(tmpDir, testCase.target))).toBe(false);
         }
+      },
+    );
   });
 
   it("blocks sort --compress-program from bypassing safeBins", async () => {
-    if (process.platform === "win32") {
+    await withSafeBinsExecTool(
-      return;
+      {
-    }
-
-    const { tmpDir, execTool } = await createSafeBinsExecTool({
         tmpPrefix: "openclaw-safe-bins-sort-compress-",
         safeBins: ["sort"],
-    });
+      },
-
+      async ({ tmpDir, execTool }) => {
         await expect(
           execTool.execute("call1", {
             command: "sort --compress-program=sh",
             workdir: tmpDir,
           }),
         ).rejects.toThrow("exec denied: allowlist miss");
+      },
+    );
   });
 
   it("blocks shell redirection metacharacters in safeBins mode", async () => {
-    if (process.platform === "win32") {
+    await withSafeBinsExecTool(
-      return;
+      {
-    }
-
-    const { tmpDir, execTool } = await createSafeBinsExecTool({
         tmpPrefix: "openclaw-safe-bins-redirect-",
         safeBins: ["head"],
         files: [{ name: "source.txt", contents: "line1\nline2\n" }],
-    });
+      },
-
+      async ({ tmpDir, execTool }) => {
         await expect(
           execTool.execute("call1", {
             command: "head -n 1 source.txt > blocked-redirect.txt",
@@ -254,24 +261,25 @@ describe("createOpenClawCodingTools safeBins", () => {
           }),
         ).rejects.toThrow("exec denied: allowlist miss");
         expect(fs.existsSync(path.join(tmpDir, "blocked-redirect.txt"))).toBe(false);
+      },
+    );
   });
 
   it("blocks grep recursive flags from reading cwd via safeBins", async () => {
-    if (process.platform === "win32") {
+    await withSafeBinsExecTool(
-      return;
+      {
-    }
-
-    const { tmpDir, execTool } = await createSafeBinsExecTool({
         tmpPrefix: "openclaw-safe-bins-grep-",
         safeBins: ["grep"],
         files: [{ name: "secret.txt", contents: "SAFE_BINS_RECURSIVE_SHOULD_NOT_LEAK\n" }],
-    });
+      },
-
+      async ({ tmpDir, execTool }) => {
         await expect(
           execTool.execute("call1", {
             command: "grep -R SAFE_BINS_RECURSIVE_SHOULD_NOT_LEAK",
             workdir: tmpDir,
           }),
         ).rejects.toThrow("exec denied: allowlist miss");
+      },
+    );
   });
 });