doctor: require searchable config write parents

giodl73-repo · giodl73-repo · commit c1a0a58b2b31 · 2026-07-05T09:04:49.000-07:00
diff --git a/src/flows/doctor-health-contributions.test.ts b/src/flows/doctor-health-contributions.test.ts
@@ -2775,7 +2775,10 @@ describe("doctor health contributions", () => {
       ).resolves.toMatchObject({
         findings: [],
       });
-      expect(accessSpy).toHaveBeenCalledWith("/tmp/openclaw-home", fs.constants.W_OK);
+      expect(accessSpy).toHaveBeenCalledWith(
+        "/tmp/openclaw-home",
+        fs.constants.W_OK | fs.constants.X_OK,
+      );
     });
 
     it("reports an unwritable config directory for an existing config", async () => {
@@ -2827,7 +2830,7 @@ describe("doctor health contributions", () => {
       ).resolves.toMatchObject({
         findings: [],
       });
-      expect(accessSpy).toHaveBeenCalledWith("/tmp", fs.constants.W_OK);
+      expect(accessSpy).toHaveBeenCalledWith("/tmp", fs.constants.W_OK | fs.constants.X_OK);
     });
 
     it("reports an unwritable existing parent when the config file is missing", async () => {
@@ -2858,6 +2861,36 @@ describe("doctor health contributions", () => {
       });
     });
 
+    it("reports an existing parent without search permission", async () => {
+      vi.spyOn(fs, "existsSync").mockImplementation((path) => path === "/tmp");
+      vi.spyOn(fs, "accessSync").mockImplementation((_path, mode) => {
+        if (mode === (fs.constants.W_OK | fs.constants.X_OK)) {
+          throw new Error("EACCES");
+        }
+      });
+
+      await expect(
+        runDoctorLintChecks(
+          {
+            cfg: {},
+            mode: "lint" as const,
+            runtime: { log: vi.fn(), error: vi.fn(), exit: vi.fn() },
+            configPath: "/tmp/openclaw-home/openclaw.json",
+          },
+          { checks: [check], onlyIds: ["core/doctor/write-config"] },
+        ),
+      ).resolves.toMatchObject({
+        findings: [
+          expect.objectContaining({
+            checkId: "core/doctor/write-config",
+            path: "/tmp",
+            target: "/tmp/openclaw-home",
+            requirement: "writable-config-directory",
+          }),
+        ],
+      });
+    });
+
     it("reports an existing file that blocks the config directory path", async () => {
       vi.spyOn(fs, "existsSync").mockImplementation((path) => path === "/tmp/openclaw-home");
       vi.spyOn(fs, "statSync").mockReturnValue({
diff --git a/src/flows/doctor-health-contributions.ts b/src/flows/doctor-health-contributions.ts
@@ -1347,7 +1347,7 @@ async function collectWriteConfigHealthFindings(
     return findings;
   }
   try {
-    fs.accessSync(existingParent, fs.constants.W_OK);
+    fs.accessSync(existingParent, fs.constants.W_OK | fs.constants.X_OK);
   } catch {
     findings.push({
       checkId: "core/doctor/write-config",

Original file line number	Diff line number	Diff line change
`@@ -1347,7 +1347,7 @@ async function collectWriteConfigHealthFindings(`
`1347`	`1347`	`return findings;`
`1348`	`1348`	`}`
`1349`	`1349`	`try {`
`1350`		`- fs.accessSync(existingParent, fs.constants.W_OK);`
	`1350`	`+ fs.accessSync(existingParent, fs.constants.W_OK \| fs.constants.X_OK);`
`1351`	`1351`	`} catch {`
`1352`	`1352`	`findings.push({`
`1353`	`1353`	`checkId: "core/doctor/write-config",`