mirror of
https://github.com/larksuite/cli.git
synced 2026-07-06 08:12:36 +08:00
AI agents running inside OpenClaw / Hermes were routinely creating a parallel
app via `config init --new` instead of binding to the agent's existing app,
because every "not configured" hint and several deny errors hard-coded
`config init` regardless of workspace. Once bound, the same agents could
silently grant themselves user identity (impersonation) without the user
ever seeing a risk message in chat.
Changes:
- Introduce `core.NotConfiguredError` / `NoActiveProfileError` /
`reconfigureHint` helpers that branch on `CurrentWorkspace()`. In agent
workspaces they point at `lark-cli config bind --help` (a help page, not
a ready-to-run command) so AI must read the binding workflow and confirm
identity preset with the user before acting. In local terminals they
preserve the previous `config init --new` guidance.
- Migrate every `config init` hint that should be workspace-aware:
RequireConfigForProfile, default credential provider, credential provider
fallback, secret-resolve mismatch, config show, strict-mode entry-point
errors, default-as, profile use/rename/remove, auth list, doctor's
config_file check (which now also wraps the OS-level "no such file"
noise into the user-shaped "not configured" message).
- Refuse `config init` when run inside an OpenClaw / Hermes workspace by
default; add `--force-init` for the rare case the user genuinely wants
a parallel app. Without this guard, hint fixes were undone the moment
AI ignored them.
- Rewrite the strict-mode deny errors in cmd/auth/login.go, cmd/prune.go,
and internal/cmdutil/factory.go. The previous "AI agents are strictly
prohibited from modifying this setting" terminated AI reasoning while
providing no real gate. New errors point at `config strict-mode --help`
with the legitimate confirmation flow and explicitly note that switching
does NOT require re-bind. Integration test envelopes updated.
- Tighten `config bind --help` and `config strict-mode --help` to encode
the user-confirmation discipline directly: identity preset semantics
(bot-only vs user-default), "DO NOT switch without explicit user
confirmation", and a cross-reference clarifying that `config bind` is
for changing the underlying app while `config strict-mode` is the
policy-only switch (resolves an ambiguity an audit run found).
- Surface user-identity (impersonation) risk at every config write that
newly grants it, by reusing the canonical IdentityEscalationMessage
string from bind_messages.go:
- `noticeUserDefaultRisk` fires on flag-mode bind landing on
user-default, including the first-time case `warnIdentityEscalation`
misses (it requires a previous bot lock).
- `setStrictMode` warns when transitioning bot → user or bot → off
(newly permits user identity); stays quiet on narrowing changes
and on off → user (off already permitted user).
- Add tests: notconfigured_test.go (workspace branches),
init_guard_test.go (refuse + --force-init bypass), bind_warning_test.go
(user-default warning fires; bot-only does not), strict_mode_warning_test.go
(5 transitions covering both warn and no-warn paths).
Two follow-ups intentionally deferred: the keychain master-key hint at
internal/keychain/keychain.go:42 still suggests `config init` because the
keychain package can't import core (would be circular); fixing requires
either parameterizing the hint via callback or extracting workspace into
its own package. The lark-shared skill doc still tells AI to run
`config init` for first-time setup; updating the skill is in scope for
a follow-up PR.
Change-Id: I02273e044d9e061d211ceaa4f3ed5a3fb28325b3
182 lines
5.7 KiB
Go
182 lines
5.7 KiB
Go
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package core
|
|
|
|
import (
|
|
"errors"
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// saveAndRestoreWorkspace ensures package-level currentWorkspace is reset
|
|
// between subtests so cross-test pollution can't make assertions pass by
|
|
// accident.
|
|
func saveAndRestoreWorkspace(t *testing.T) {
|
|
t.Helper()
|
|
prev := CurrentWorkspace()
|
|
t.Cleanup(func() { SetCurrentWorkspace(prev) })
|
|
}
|
|
|
|
func TestNotConfiguredError_Local(t *testing.T) {
|
|
saveAndRestoreWorkspace(t)
|
|
SetCurrentWorkspace(WorkspaceLocal)
|
|
|
|
err := NotConfiguredError()
|
|
var cfgErr *ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("error type = %T, want *ConfigError", err)
|
|
}
|
|
if cfgErr.Type != "config" || cfgErr.Message != "not configured" {
|
|
t.Errorf("unexpected detail: %+v", cfgErr)
|
|
}
|
|
if !strings.Contains(cfgErr.Hint, "config init --new") {
|
|
t.Errorf("local hint should suggest config init --new; got %q", cfgErr.Hint)
|
|
}
|
|
if strings.Contains(cfgErr.Hint, "config bind") {
|
|
t.Errorf("local hint must not mention config bind; got %q", cfgErr.Hint)
|
|
}
|
|
}
|
|
|
|
func TestNotConfiguredError_OpenClaw(t *testing.T) {
|
|
saveAndRestoreWorkspace(t)
|
|
SetCurrentWorkspace(WorkspaceOpenClaw)
|
|
|
|
err := NotConfiguredError()
|
|
var cfgErr *ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("error type = %T, want *ConfigError", err)
|
|
}
|
|
if cfgErr.Type != "openclaw" {
|
|
t.Errorf("type = %q, want %q", cfgErr.Type, "openclaw")
|
|
}
|
|
// Hint must point at --help (read first, confirm with user, then bind),
|
|
// NOT a directly-executable bind command — binding is policy-laden
|
|
// (identity preset, may overwrite existing binding).
|
|
if !strings.Contains(cfgErr.Hint, "config bind --help") {
|
|
t.Errorf("agent hint must point to `config bind --help`; got %q", cfgErr.Hint)
|
|
}
|
|
if strings.Contains(cfgErr.Hint, "config init") {
|
|
t.Errorf("agent hint must NOT mention config init (would cause AI to create a new app); got %q", cfgErr.Hint)
|
|
}
|
|
}
|
|
|
|
func TestNotConfiguredError_Hermes(t *testing.T) {
|
|
saveAndRestoreWorkspace(t)
|
|
SetCurrentWorkspace(WorkspaceHermes)
|
|
|
|
err := NotConfiguredError()
|
|
var cfgErr *ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("error type = %T, want *ConfigError", err)
|
|
}
|
|
if cfgErr.Type != "hermes" {
|
|
t.Errorf("type = %q, want %q", cfgErr.Type, "hermes")
|
|
}
|
|
if !strings.Contains(cfgErr.Hint, "config bind --help") {
|
|
t.Errorf("hermes hint must point to `config bind --help`; got %q", cfgErr.Hint)
|
|
}
|
|
}
|
|
|
|
func TestNoActiveProfileError_Local(t *testing.T) {
|
|
saveAndRestoreWorkspace(t)
|
|
SetCurrentWorkspace(WorkspaceLocal)
|
|
|
|
err := NoActiveProfileError()
|
|
var cfgErr *ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("error type = %T, want *ConfigError", err)
|
|
}
|
|
if cfgErr.Message != "no active profile" {
|
|
t.Errorf("message = %q, want %q", cfgErr.Message, "no active profile")
|
|
}
|
|
}
|
|
|
|
func TestNoActiveProfileError_AgentSuggestsBind(t *testing.T) {
|
|
saveAndRestoreWorkspace(t)
|
|
SetCurrentWorkspace(WorkspaceOpenClaw)
|
|
|
|
err := NoActiveProfileError()
|
|
var cfgErr *ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("error type = %T, want *ConfigError", err)
|
|
}
|
|
if !strings.Contains(cfgErr.Hint, "config bind --help") {
|
|
t.Errorf("agent hint must point to `config bind --help`; got %q", cfgErr.Hint)
|
|
}
|
|
}
|
|
|
|
func TestReconfigureHint_Local(t *testing.T) {
|
|
saveAndRestoreWorkspace(t)
|
|
SetCurrentWorkspace(WorkspaceLocal)
|
|
|
|
got := reconfigureHint()
|
|
if !strings.Contains(got, "config init") {
|
|
t.Errorf("local reconfigure hint must mention config init; got %q", got)
|
|
}
|
|
}
|
|
|
|
func TestReconfigureHint_Agent(t *testing.T) {
|
|
saveAndRestoreWorkspace(t)
|
|
SetCurrentWorkspace(WorkspaceHermes)
|
|
|
|
got := reconfigureHint()
|
|
if !strings.Contains(got, "config bind --help") {
|
|
t.Errorf("agent reconfigure hint must point to `config bind --help`; got %q", got)
|
|
}
|
|
}
|
|
|
|
func TestLoadOrNotConfigured_FileMissing_ReturnsNotConfigured(t *testing.T) {
|
|
saveAndRestoreWorkspace(t)
|
|
SetCurrentWorkspace(WorkspaceLocal)
|
|
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
|
|
|
|
_, err := LoadOrNotConfigured()
|
|
if err == nil {
|
|
t.Fatal("expected error")
|
|
}
|
|
var cfgErr *ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("error type = %T, want *ConfigError", err)
|
|
}
|
|
if cfgErr.Message != "not configured" {
|
|
t.Errorf("message = %q, want \"not configured\"", cfgErr.Message)
|
|
}
|
|
if !strings.Contains(cfgErr.Hint, "config init --new") {
|
|
t.Errorf("missing-file in local must hint `config init --new`; got %q", cfgErr.Hint)
|
|
}
|
|
}
|
|
|
|
// TestLoadOrNotConfigured_CorruptFile_PreservesCause is the regression guard
|
|
// for the previous "every load error → not configured" coercion: a malformed
|
|
// config.json must surface its real failure cause so the user can fix it,
|
|
// not get sent in circles by an init/bind hint that wouldn't help here.
|
|
func TestLoadOrNotConfigured_CorruptFile_PreservesCause(t *testing.T) {
|
|
dir := t.TempDir()
|
|
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
|
|
// Write garbage that will fail JSON parsing.
|
|
if err := os.WriteFile(dir+"/config.json", []byte("{not valid json"), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
_, err := LoadOrNotConfigured()
|
|
if err == nil {
|
|
t.Fatal("expected error for corrupt config")
|
|
}
|
|
var cfgErr *ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("error type = %T, want *ConfigError", err)
|
|
}
|
|
if !strings.Contains(cfgErr.Message, "failed to load config") {
|
|
t.Errorf("corrupt-file message must say 'failed to load config'; got %q", cfgErr.Message)
|
|
}
|
|
// And it must NOT pretend the user just hasn't initialised yet.
|
|
if cfgErr.Message == "not configured" {
|
|
t.Errorf("corrupt-file must not be coerced to 'not configured'")
|
|
}
|
|
if strings.Contains(cfgErr.Hint, "config init") || strings.Contains(cfgErr.Hint, "config bind") {
|
|
t.Errorf("corrupt-file hint must not redirect to init/bind; got %q", cfgErr.Hint)
|
|
}
|
|
}
|