starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-09-22 16:02:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(preflight): reject Windows paths from WSL agent lookup (#7994)

Browse Source 
* fix(preflight): reject Windows paths from WSL lookup

WSL agent discovery previously treated path.win32 absolute results as
valid guest paths, so a Windows absolute path like C:\spoof could be
counted as a found agent. Only POSIX absolute paths are valid inside WSL.

* docs(preflight): explain WSL path boundary

* docs(preflight): correct WSL path rejection rationale

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
BingZ
2026-07-11 21:21:18 -07:00
committed by GitHub
co-authored by Orca Jinjing
parent 9d3d813a23
commit 1eace14c57
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/ipc/preflight-wsl-agent-detection.test.ts
+2 -2
View File
@@ -78,11 +78,11 @@ describe('detectWslCommandsOnPath', () => {
it('ignores commands whose resolved path is not absolute', async () => {
execFileAsyncMock.mockResolvedValue({
stdout: '__ORCA_AGENT_PATH__claude\tclaude\n',
stdout: '__ORCA_AGENT_PATH__claude\tclaude\n' + '__ORCA_AGENT_PATH__codex\tC:\\spoof\n',
stderr: ''
})
const found = await detectWslCommandsOnPath({ distro: 'Ubuntu' }, ['claude'])
const found = await detectWslCommandsOnPath({ distro: 'Ubuntu' }, ['claude', 'codex'])
expect(found).toEqual(new Set())
})
src/main/ipc/preflight-wsl-agent-detection.ts
+3 -1
View File
@@ -114,7 +114,9 @@ function parseWslDetectedCommands(stdout: string): Set<string> {
}
const command = payload.slice(0, separatorIndex)
const resolvedPath = payload.slice(separatorIndex + 1)
if (path.posix.isAbsolute(resolvedPath) || path.win32.isAbsolute(resolvedPath)) {
// Why: a real guest executable always resolves to a POSIX-absolute path, so
// a Windows-style C:\ path here is spoofed/non-guest output, not an install.
if (path.posix.isAbsolute(resolvedPath)) {
found.add(command)
}
}