Merge PR #6222: fix(write): reject unknown URI-like targets (@roboomp)

2026-07-22 21:13:20 +02:00
parent 1581a9719d b2e7e34567
commit c5489fa5c5
3 changed files with 67 additions and 0 deletions
@@ -86,6 +86,38 @@ describe("read and write route xd:// device URLs", () => {
 		}
 	});

+	it("rejects near-miss xd addresses before filesystem fallback", async () => {
+		const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "write-xdev-near-miss-"));
+		try {
+			const tools = await createTools(xdevSession(tempDir));
+			const write = tools.find(entry => entry.name === "write");
+			expect(write).toBeDefined();
+
+			for (const target of ["xdt://web_search", "xd:/web_search", "xd/web_search"]) {
+				await expect(write!.execute(`write-${target}`, { path: target, content: "{}" })).rejects.toThrow(
+					"Did you mean 'xd://web_search'?",
+				);
+			}
+			expect(await Bun.file(path.join(tempDir, "xdt:/web_search")).exists()).toBe(false);
+			expect(await Bun.file(path.join(tempDir, "xd/web_search")).exists()).toBe(false);
+
+			const escaped = await write!.execute("write-explicit-path", {
+				path: "./xd/web_search",
+				content: "intentional file",
+			});
+			expect(escaped.isError).toBeUndefined();
+			expect(await Bun.file(path.join(tempDir, "xd/web_search")).text()).toBe("intentional file");
+
+			// conflict:// has no router handler but is a documented write scheme —
+			// the guard must let it reach the conflict resolver, not reject it.
+			await expect(write!.execute("write-conflict", { path: "conflict://1", content: "x" })).rejects.toThrow(
+				"Conflict #1 not found",
+			);
+		} finally {
+			await removeWithRetries(tempDir);
+		}
+	});
+
 	it("resolves function-valued device approvals per payload and fails closed on bad content", async () => {
 		const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "write-xdev-approval-"));
 		try {