fix(test): use NTFS junctions and platform guards for symlink tests on Windows by arosstale · Pull Request #28747 · openclaw/openclaw

arosstale · 2026-02-27T13:40:31Z

Summary

Fixes 7 test failures on Windows caused by fs.symlink() requiring SeCreateSymbolicLinkPrivilege (admin or Developer Mode enabled).

Failing tests (before this PR):

File	Test	Symlink Type	Fix
`apply-patch.test.ts`	rejects symlink escape attempts by default	file → file	platform guard
`apply-patch.test.ts`	allows symlinks that resolve within cwd by default	file → file	platform guard
`apply-patch.test.ts`	rejects delete path traversal via symlink directories	dir → dir	junction
`apply-patch.test.ts`	allows deleting a symlink itself even if it points outside cwd	dir → dir	junction
`archive.test.ts`	rejects zip entries that traverse pre-existing destination symlinks	dir → dir	junction
`fs-bridge.test.ts`	rejects pre-existing host symlink escapes before docker exec	file → file	platform guard
`validate-sandbox-security.test.ts`	blocks symlink escapes into blocked directories	dir → nonexistent	move guard before symlink

Approach

Three strategies based on symlink target type:

Directory symlinks → NTFS junctions (fs.symlink(target, link, 'junction')): Junctions don't require elevated privileges on Windows and lstat().isSymbolicLink() correctly returns true for them, so all security checks still exercise the real code path.
File symlinks → platform guard (if (process.platform === 'win32') return): File symlinks have no unprivileged alternative on Windows. This matches the existing pattern already used in adjacent tests (e.g. rejects broken final symlink targets outside cwd, rejects hardlink alias escapes).
Guard ordering fix (validate-sandbox-security.test.ts): The existing win32 guard was placed after symlinkSync("/etc", link), so the EPERM happened before the guard could skip the test. Moved the guard before the symlink creation and restructured to avoid needing a real symlink on Windows.

Testing

All 4 test files pass on Windows 11 22H2 / Node v22.22.0 / NTFS (non-admin):

✓ apply-patch.test.ts                  13 passed
✓ archive.test.ts                      11 passed
✓ fs-bridge.test.ts                     9 passed
✓ validate-sandbox-security.test.ts    24 passed
                                       57 total

No changes to production code — test-only fix.

Linked Issues

None (discovered via Windows CI test run).

greptile-apps · 2026-02-27T13:42:30Z

Greptile Summary

This PR fixes 6 Windows test failures caused by symlink privilege requirements by using two strategies: NTFS junctions for directory symlinks (which don't require elevated privileges and are correctly identified by lstat().isSymbolicLink()) and platform guards for file symlinks (matching existing patterns in the codebase). All changes are test-only with no production code modifications, and the approach preserves security checks since junctions are still detected as symlinks by Node.js.

Uses 'junction' type for directory symlinks on Windows in 3 tests across apply-patch.test.ts and archive.test.ts
Adds platform guards with early returns for 3 file symlink tests across apply-patch.test.ts and fs-bridge.test.ts, consistent with existing Windows guard patterns
Includes clear comments explaining the Windows privilege requirements (SeCreateSymbolicLinkPrivilege)
Properly handles cleanup in fs-bridge.test.ts before early return since resources were already allocated

Confidence Score: 5/5

This PR is safe to merge with no risk - it only modifies test files to handle Windows platform differences.
Score reflects test-only changes that follow existing codebase patterns, preserve security checks, and solve a real Windows compatibility issue without touching production code.
No files require special attention.

_{Last reviewed commit: 904f274}

…n Windows On Windows, creating symbolic links requires SeCreateSymbolicLinkPrivilege (admin or Developer Mode). This causes 7 test failures across 4 files: - apply-patch.test.ts: 4 failures - archive.test.ts: 1 failure - fs-bridge.test.ts: 1 failure - validate-sandbox-security.test.ts: 1 failure Fix: - For directory symlinks: pass 'junction' type to fs.symlink(). NTFS junctions don't require elevated privileges and lstat().isSymbolicLink() correctly returns true for them, so security checks still exercise the real code path. - For file symlinks: skip on Windows with platform guard, matching the existing pattern already used in adjacent tests. - For validate-sandbox-security: move the platform guard before the symlinkSync call (was after it, causing EPERM before the guard ran).

…aw#28747

Copilot

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

Takhoffman · 2026-03-02T16:45:28Z

PR #28747 - fix(test): use NTFS junctions and platform guards for symlink tests on Windows (#28747)

Merged after verification.

Merge commit: 1b462ed
Verified: pnpm install --frozen-lockfile; pnpm test src/agents/apply-patch.test.ts src/agents/sandbox/fs-bridge.test.ts src/agents/sandbox/validate-sandbox-security.test.ts src/infra/archive.test.ts
Autoland updates:
M CHANGELOG.md
Rationale:
Merged as the canonical Windows symlink-portability fix; kept security assertions intact where unprivileged Windows semantics allow deterministic coverage.
Changelog: CHANGELOG.md updated=true required=true opt_out=false

@arosstale

…n Windows (openclaw#28747) thanks @arosstale Verified: - pnpm install --frozen-lockfile - pnpm test src/agents/apply-patch.test.ts src/agents/sandbox/fs-bridge.test.ts src/agents/sandbox/validate-sandbox-security.test.ts src/infra/archive.test.ts Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

@arosstale

…n Windows (openclaw#28747) thanks @arosstale Verified: - pnpm install --frozen-lockfile - pnpm test src/agents/apply-patch.test.ts src/agents/sandbox/fs-bridge.test.ts src/agents/sandbox/validate-sandbox-security.test.ts src/infra/archive.test.ts Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

@arosstale

…n Windows (openclaw#28747) thanks @arosstale Verified: - pnpm install --frozen-lockfile - pnpm test src/agents/apply-patch.test.ts src/agents/sandbox/fs-bridge.test.ts src/agents/sandbox/validate-sandbox-security.test.ts src/infra/archive.test.ts Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

@arosstale

…n Windows (openclaw#28747) thanks @arosstale Verified: - pnpm install --frozen-lockfile - pnpm test src/agents/apply-patch.test.ts src/agents/sandbox/fs-bridge.test.ts src/agents/sandbox/validate-sandbox-security.test.ts src/infra/archive.test.ts Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

openclaw-barnacle bot added agents Agent runtime and tooling size: XS experienced-contributor labels Feb 27, 2026

openclaw-barnacle bot added size: S and removed size: XS labels Feb 27, 2026

artale and others added 2 commits March 2, 2026 10:43

docs(changelog): add Windows symlink test portability note for opencl…

ae90023

…aw#28747

Takhoffman force-pushed the fix/windows-symlink-test-eperm branch from e1c636f to ae90023 Compare March 2, 2026 16:45

Copilot AI review requested due to automatic review settings March 2, 2026 16:45

Copilot AI reviewed Mar 2, 2026

View reviewed changes

Takhoffman merged commit 1b462ed into openclaw:main Mar 2, 2026
6 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(test): use NTFS junctions and platform guards for symlink tests on Windows#28747

fix(test): use NTFS junctions and platform guards for symlink tests on Windows#28747
Takhoffman merged 2 commits intoopenclaw:mainfrom
arosstale:fix/windows-symlink-test-eperm

arosstale commented Feb 27, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Feb 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Takhoffman commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

arosstale commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Approach

Testing

Linked Issues

Uh oh!

greptile-apps bot commented Feb 27, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Takhoffman commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

arosstale commented Feb 27, 2026 •

edited

Loading