fix: address DCG binary service feedback

Author: navedmerchant

src/services/destructive-command-guard/__tests__/manager.spec.ts

@@ -130,6 +130,13 @@ describe("Destructive Command Guard manager", () => {
 
 	it("allows trusted relative redirects and rejects unsafe or exhausted redirects", () => {
 		expect(resolveTrustedRedirect("https://github.com/release", "/asset", 5)).toBe("https://github.com/asset")
+		expect(
+			resolveTrustedRedirect(
+				"https://github.com/release",
+				"https://release-assets.githubusercontent.com/asset",
+				5,
+			),
+		).toBe("https://release-assets.githubusercontent.com/asset")
 		expect(() => resolveTrustedRedirect("https://github.com/release", "https://example.com/asset", 5)).toThrow(
 			"DCG download redirected to an untrusted host",
 		)
@@ -322,56 +329,59 @@ describe("Destructive Command Guard manager", () => {
 		}
 	})
 
-	it("downloads, verifies, extracts, and installs a ZIP archive", async () => {
-		const info = getDcgArchiveInfo()
-		if (!info?.archive.endsWith(".zip")) return
-
-		const archive = Buffer.from("test ZIP archive")
-		const originalChecksum = info.sha256
-		Object.defineProperty(info, "sha256", {
-			value: createHash("sha256").update(archive).digest("hex"),
-			configurable: true,
-		})
-		const response = Object.assign(new PassThrough(), {
-			statusCode: 200,
-			headers: { "content-length": String(archive.length) },
-		})
-		const request = Object.assign(new EventEmitter(), { setTimeout: vi.fn(), destroy: vi.fn() })
-		mockGet.mockImplementation((_url, optionsOrCallback, optionalCallback) => {
-			const callback = typeof optionsOrCallback === "function" ? optionsOrCallback : optionalCallback
-			setImmediate(() => {
-				callback?.(response as unknown as IncomingMessage)
-				response.end(archive)
+	it.skipIf(!getDcgArchiveInfo()?.archive.endsWith(".zip"))(
+		"downloads, verifies, extracts, and installs a ZIP archive",
+		async () => {
+			const info = getDcgArchiveInfo()
+			if (!info) throw new Error("Expected a ZIP archive in this test")
+
+			const archive = Buffer.from("test ZIP archive")
+			const originalChecksum = info.sha256
+			Object.defineProperty(info, "sha256", {
+				value: createHash("sha256").update(archive).digest("hex"),
+				configurable: true,
 			})
-			return request as unknown as ReturnType<typeof get>
-		})
-		mockSpawn.mockImplementation((_executable, args) => {
-			const child = Object.assign(new EventEmitter(), {
-				stdout: new PassThrough(),
-				stderr: new PassThrough(),
-				kill: vi.fn(),
+			const response = Object.assign(new PassThrough(), {
+				statusCode: 200,
+				headers: { "content-length": String(archive.length) },
 			})
-			setImmediate(async () => {
-				const destinationIndex = args.indexOf(
-					"$archivePath = $args[0]; $destination = $args[1]; Expand-Archive -LiteralPath $archivePath -DestinationPath $destination -Force",
-				)
-				const stagingDir = args[destinationIndex + 2]
-				await writeFile(path.join(stagingDir, info.binary), "ZIP executable")
-				child.emit("close", 0)
+			const request = Object.assign(new EventEmitter(), { setTimeout: vi.fn(), destroy: vi.fn() })
+			mockGet.mockImplementation((_url, optionsOrCallback, optionalCallback) => {
+				const callback = typeof optionsOrCallback === "function" ? optionsOrCallback : optionalCallback
+				setImmediate(() => {
+					callback?.(response as unknown as IncomingMessage)
+					response.end(archive)
+				})
+				return request as unknown as ReturnType<typeof get>
+			})
+			mockSpawn.mockImplementation((_executable, args) => {
+				const child = Object.assign(new EventEmitter(), {
+					stdout: new PassThrough(),
+					stderr: new PassThrough(),
+					kill: vi.fn(),
+				})
+				setImmediate(async () => {
+					const destinationIndex = args.indexOf(
+						"$archivePath = $args[0]; $destination = $args[1]; Expand-Archive -LiteralPath $archivePath -DestinationPath $destination -Force",
+					)
+					const stagingDir = args[destinationIndex + 2]
+					await writeFile(path.join(stagingDir, info.binary), "ZIP executable")
+					child.emit("close", 0)
+				})
+				return child as unknown as ReturnType<typeof spawn>
 			})
-			return child as unknown as ReturnType<typeof spawn>
-		})
 
-		try {
-			const binaryPath = await ensureDcgInstalled(tempDir)
-			if (!binaryPath) throw new Error("Expected DCG to be supported in this test")
-			expect(await readFile(binaryPath, "utf8")).toBe("ZIP executable")
-			expect(await readFile(path.join(tempDir, "destructive-command-guard", ".dcg-version"), "utf8")).toBe(
-				DCG_VERSION,
-			)
-			await expect(access(path.join(tempDir, `${DCG_VERSION}-${info.archive}`))).rejects.toThrow()
-		} finally {
-			Object.defineProperty(info, "sha256", { value: originalChecksum, configurable: true })
-		}
-	})
+			try {
+				const binaryPath = await ensureDcgInstalled(tempDir)
+				if (!binaryPath) throw new Error("Expected DCG to be supported in this test")
+				expect(await readFile(binaryPath, "utf8")).toBe("ZIP executable")
+				expect(await readFile(path.join(tempDir, "destructive-command-guard", ".dcg-version"), "utf8")).toBe(
+					DCG_VERSION,
+				)
+				await expect(access(path.join(tempDir, `${DCG_VERSION}-${info.archive}`))).rejects.toThrow()
+			} finally {
+				Object.defineProperty(info, "sha256", { value: originalChecksum, configurable: true })
+			}
+		},
+	)
 })

src/services/destructive-command-guard/__tests__/runner.spec.ts

@@ -83,19 +83,23 @@ describe("runDcg", () => {
 		const child = createChild()
 		useChild(child)
 		const originalToken = process.env.GITHUB_TOKEN
+		const originalTmpdir = process.env.TMPDIR
 		process.env.GITHUB_TOKEN = "secret"
+		process.env.TMPDIR = "/sandbox/tmp"
 
 		try {
 			const result = runDcg("/dcg", "echo test", "/workspace")
 			emitResult(child, { schema_version: 1, decision: "allow" }, 0)
 			await result
 
 			const options = mockSpawn.mock.calls[0][2]
-			expect(options?.env).toMatchObject({ NO_COLOR: "1" })
+			expect(options?.env).toMatchObject({ NO_COLOR: "1", TMPDIR: "/sandbox/tmp" })
 			expect(options?.env).not.toHaveProperty("GITHUB_TOKEN")
 		} finally {
 			if (originalToken === undefined) delete process.env.GITHUB_TOKEN
 			else process.env.GITHUB_TOKEN = originalToken
+			if (originalTmpdir === undefined) delete process.env.TMPDIR
+			else process.env.TMPDIR = originalTmpdir
 		}
 	})
 

src/services/destructive-command-guard/runner.ts

@@ -13,7 +13,7 @@ type DcgJsonOutput = {
 	pack_id?: string
 }
 
-const DCG_ENV_KEYS = ["HOME", "PATH", "TEMP", "TMP", "USERPROFILE", "SystemRoot", "WINDIR"] as const
+const DCG_ENV_KEYS = ["HOME", "PATH", "TEMP", "TMPDIR", "TMP", "USERPROFILE", "SystemRoot", "WINDIR"] as const
 
 function getDcgEnvironment(): NodeJS.ProcessEnv {
 	const env: NodeJS.ProcessEnv = { NO_COLOR: "1" }