test/sandbox-provisioning.test.js (1)

68-83: Consider extracting fs.readFileSync to reduce redundant I/O.

The Dockerfile content is read separately in each parameterized test iteration. While this works correctly, reading once at describe-block scope would be cleaner and slightly faster.

♻️ Optional: Extract file read to describe scope

 describe("sandbox provisioning: all expected symlinks present in Dockerfile.base", () => {
   const EXPECTED_DIR_SYMLINKS = [
     "agents", "extensions", "workspace", "skills", "hooks",
     "identity", "devices", "canvas", "cron", "memory",
   ];
   const EXPECTED_FILE_SYMLINKS = ["update-check.json", "exec-approvals.json"];
+  const dockerfileBaseSrc = fs.readFileSync(DOCKERFILE_BASE, "utf-8");

   it.each(EXPECTED_DIR_SYMLINKS)("symlink for directory '%s' is created", (name) => {
-    const src = fs.readFileSync(DOCKERFILE_BASE, "utf-8");
-    expect(src).toContain(`ln -s /sandbox/.openclaw-data/${name} /sandbox/.openclaw/${name}`);
+    expect(dockerfileBaseSrc).toContain(`ln -s /sandbox/.openclaw-data/${name} /sandbox/.openclaw/${name}`);
   });

   it.each(EXPECTED_FILE_SYMLINKS)("symlink for file '%s' is created", (name) => {
-    const src = fs.readFileSync(DOCKERFILE_BASE, "utf-8");
-    expect(src).toContain(`ln -s /sandbox/.openclaw-data/${name} /sandbox/.openclaw/${name}`);
+    expect(dockerfileBaseSrc).toContain(`ln -s /sandbox/.openclaw-data/${name} /sandbox/.openclaw/${name}`);
   });
 });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/sandbox-provisioning.test.js` around lines 68 - 83, Move the
fs.readFileSync(DOCKERFILE_BASE, "utf-8") call out of each it.each and into the
surrounding describe scope so the Dockerfile contents are read once; create a
local const (e.g. dockerfileSrc) in the describe block and replace the per-test
reads in the it.each blocks that reference EXPECTED_DIR_SYMLINKS and
EXPECTED_FILE_SYMLINKS to use dockerfileSrc instead.

test/e2e-gateway-isolation.sh (1)

193-206: Consider unifying the assertion style with Tests 2 and 5.

Test 9d splits the stat output with awk for separate owner/permissions checks, while Tests 2 and 5 use exact string matching. Both approaches are correct, but unifying them would improve maintainability.

♻️ Optional: unified approach matching Tests 2/5

 info "9d. /sandbox/.openclaw/ directory is owned by root:root with permissions 755"
 OUT=$(run_as_root "stat -c '%U:%G %a' /sandbox/.openclaw")
-OWNER=$(echo "$OUT" | awk '{print $1}')
-DIR_PERMS=$(echo "$OUT" | awk '{print $2}')
-if [ "$OWNER" = "root:root" ]; then
-  pass ".openclaw directory owned by root:root"
+if [ "$OUT" = "root:root 755" ]; then
+  pass ".openclaw directory is root:root 755"
 else
-  fail ".openclaw directory owner wrong: $OWNER (expected root:root)"
-fi
-if [ "$DIR_PERMS" = "755" ]; then
-  pass ".openclaw directory permissions are 755"
-else
-  fail ".openclaw directory permissions wrong: $DIR_PERMS (expected 755)"
+  fail ".openclaw directory wrong: $OUT (expected root:root 755)"
 fi

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/e2e-gateway-isolation.sh` around lines 193 - 206, Unify Test 9d to use
an exact string match like Tests 2 and 5 by comparing the full stat output
stored in OUT (from run_as_root "stat -c '%U:%G %a' /sandbox/.openclaw") against
an expected string "root:root 755"; replace the separate OWNER/DIR_PERMS awk
parsing and two checks with a single if [ "$OUT" = "root:root 755" ] then pass
".openclaw owned and perms OK" else fail ".openclaw owner/perms wrong: $OUT
(expected root:root 755)" fi, updating the pass/fail messages and keeping
references to OUT, run_as_root, pass, and fail.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes