diff --git a/src/shared/avatar-policy.test.ts b/src/shared/avatar-policy.test.ts
index cbc345767e7..9f2dadeca0c 100644
--- a/src/shared/avatar-policy.test.ts
+++ b/src/shared/avatar-policy.test.ts
@@ -39,11 +39,13 @@ describe("avatar policy", () => {
     expect(isPathWithinRoot(root, root)).toBe(true);
     expect(isPathWithinRoot(root, path.resolve("/tmp/root/avatars/a.png"))).toBe(true);
     expect(isPathWithinRoot(root, path.resolve("/tmp/root/../outside.png"))).toBe(false);
+    expect(isPathWithinRoot(root, path.resolve("/tmp/root-sibling/avatar.png"))).toBe(false);
   });
 
   it("detects avatar-like path strings", () => {
     expect(looksLikeAvatarPath("avatars/openclaw.svg")).toBe(true);
     expect(looksLikeAvatarPath("openclaw.webp")).toBe(true);
+    expect(looksLikeAvatarPath("avatar.ico")).toBe(true);
     expect(looksLikeAvatarPath("A")).toBe(false);
   });
 
diff --git a/src/shared/gateway-bind-url.test.ts b/src/shared/gateway-bind-url.test.ts
index 23dd855c4e6..5bf9c8582a5 100644
--- a/src/shared/gateway-bind-url.test.ts
+++ b/src/shared/gateway-bind-url.test.ts
@@ -3,25 +3,33 @@ import { resolveGatewayBindUrl } from "./gateway-bind-url.js";
 
 describe("shared/gateway-bind-url", () => {
   it("returns null for loopback/default binds", () => {
+    const pickTailnetHost = vi.fn(() => "100.64.0.1");
+    const pickLanHost = vi.fn(() => "192.168.1.2");
+
     expect(
       resolveGatewayBindUrl({
         scheme: "ws",
         port: 18789,
-        pickTailnetHost: () => "100.64.0.1",
-        pickLanHost: () => "192.168.1.2",
+        pickTailnetHost,
+        pickLanHost,
       }),
     ).toBeNull();
+    expect(pickTailnetHost).not.toHaveBeenCalled();
+    expect(pickLanHost).not.toHaveBeenCalled();
   });
 
   it("resolves custom binds only when custom host is present after trimming", () => {
+    const pickTailnetHost = vi.fn();
+    const pickLanHost = vi.fn();
+
     expect(
       resolveGatewayBindUrl({
         bind: "custom",
         customBindHost: " gateway.local ",
         scheme: "wss",
         port: 443,
-        pickTailnetHost: vi.fn(),
-        pickLanHost: vi.fn(),
+        pickTailnetHost,
+        pickLanHost,
       }),
     ).toEqual({
       url: "wss://gateway.local:443",
@@ -34,12 +42,14 @@ describe("shared/gateway-bind-url", () => {
         customBindHost: "   ",
         scheme: "ws",
         port: 18789,
-        pickTailnetHost: vi.fn(),
-        pickLanHost: vi.fn(),
+        pickTailnetHost,
+        pickLanHost,
       }),
     ).toEqual({
       error: "gateway.bind=custom requires gateway.customBindHost.",
     });
+    expect(pickTailnetHost).not.toHaveBeenCalled();
+    expect(pickLanHost).not.toHaveBeenCalled();
   });
 
   it("resolves tailnet and lan binds or returns clear errors", () => {
@@ -91,4 +101,21 @@ describe("shared/gateway-bind-url", () => {
       error: "gateway.bind=lan set, but no private LAN IP was found.",
     });
   });
+
+  it("returns null for unrecognized bind values without probing pickers", () => {
+    const pickTailnetHost = vi.fn(() => "100.64.0.1");
+    const pickLanHost = vi.fn(() => "192.168.1.2");
+
+    expect(
+      resolveGatewayBindUrl({
+        bind: "loopbackish",
+        scheme: "ws",
+        port: 18789,
+        pickTailnetHost,
+        pickLanHost,
+      }),
+    ).toBeNull();
+    expect(pickTailnetHost).not.toHaveBeenCalled();
+    expect(pickLanHost).not.toHaveBeenCalled();
+  });
 });