From 0f485562417744899103ebd16212036a7dc366b5 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 13 Mar 2026 18:58:22 +0000
Subject: [PATCH] test: expand install safe path coverage

---
 src/infra/install-safe-path.test.ts | 56 ++++++++++++++++++++++++++++-
 1 file changed, 55 insertions(+), 1 deletion(-)

diff --git a/src/infra/install-safe-path.test.ts b/src/infra/install-safe-path.test.ts
index 3ec0679c6cf..61ac64a2126 100644
--- a/src/infra/install-safe-path.test.ts
+++ b/src/infra/install-safe-path.test.ts
@@ -2,7 +2,33 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
-import { assertCanonicalPathWithinBase, safePathSegmentHashed } from "./install-safe-path.js";
+import {
+  assertCanonicalPathWithinBase,
+  resolveSafeInstallDir,
+  safeDirName,
+  safePathSegmentHashed,
+  unscopedPackageName,
+} from "./install-safe-path.js";
+
+describe("unscopedPackageName", () => {
+  it.each([
+    { value: "@openclaw/matrix", expected: "matrix" },
+    { value: " matrix ", expected: "matrix" },
+    { value: "", expected: "" },
+  ])("normalizes package names for %j", ({ value, expected }) => {
+    expect(unscopedPackageName(value)).toBe(expected);
+  });
+});
+
+describe("safeDirName", () => {
+  it.each([
+    { value: " matrix ", expected: "matrix" },
+    { value: "../matrix/plugin", expected: "..__matrix__plugin" },
+    { value: "dir\\plugin", expected: "dir__plugin" },
+  ])("normalizes install dir names for %j", ({ value, expected }) => {
+    expect(safeDirName(value)).toBe(expected);
+  });
+});
 
 describe("safePathSegmentHashed", () => {
   it("keeps safe names unchanged", () => {
@@ -24,6 +50,34 @@ describe("safePathSegmentHashed", () => {
   });
 });
 
+describe("resolveSafeInstallDir", () => {
+  it("resolves install dirs under the base directory", () => {
+    expect(
+      resolveSafeInstallDir({
+        baseDir: "/tmp/plugins",
+        id: "@openclaw/matrix",
+        invalidNameMessage: "invalid plugin name",
+      }),
+    ).toEqual({
+      ok: true,
+      path: path.join("/tmp/plugins", "@openclaw__matrix"),
+    });
+  });
+
+  it("rejects ids that resolve to the base directory itself", () => {
+    expect(
+      resolveSafeInstallDir({
+        baseDir: "/tmp/plugins",
+        id: "   ",
+        invalidNameMessage: "invalid plugin name",
+      }),
+    ).toEqual({
+      ok: false,
+      error: "invalid plugin name",
+    });
+  });
+});
+
 describe("assertCanonicalPathWithinBase", () => {
   it("accepts in-base directories", async () => {
     const baseDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-install-safe-"));