From 616bb4849c0df9a533af125d02ed55126e4858cb Mon Sep 17 00:00:00 2001 From: Hung Le Date: Tue, 2 Jun 2026 01:16:32 +0000 Subject: [PATCH] fix(e2e): accept non-root sandbox ownership for WhatsApp QR preload (#4522) The M-WA6b test expected root:444 for the WhatsApp compact-QR preload, but emit_sandbox_sourced_file() produces sandbox:444 in non-root mode (documented in sandbox-init.sh). Accept both root:444 and sandbox:444 since mode 444 (read-only) is the security-relevant property. Signed-off-by: Hung Le --- test/e2e/test-messaging-providers.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/test/e2e/test-messaging-providers.sh b/test/e2e/test-messaging-providers.sh index 355e5eaead1..6acef27be16 100755 --- a/test/e2e/test-messaging-providers.sh +++ b/test/e2e/test-messaging-providers.sh @@ -925,6 +925,12 @@ fi whatsapp_qr_preload_stat=$(sandbox_exec "stat -c '%U:%a' /tmp/nemoclaw-whatsapp-qr-compact.js 2>/dev/null || echo missing") if [ "$whatsapp_qr_preload_stat" = "root:444" ]; then pass "M-WA6b: WhatsApp compact-QR preload installed root:444 (#4522)" +elif [ "$whatsapp_qr_preload_stat" = "sandbox:444" ]; then + # Non-root sandbox mode: emit_sandbox_sourced_file produces sandbox:444 + # because chown root:root is skipped when id -u != 0. The file is still + # read-only (mode 444) which is the security-relevant property; ownership + # differs only in privilege-separation posture (see sandbox-init.sh). + pass "M-WA6b: WhatsApp compact-QR preload installed sandbox:444 (non-root mode) (#4522)" elif [ "$whatsapp_qr_preload_stat" = "missing" ]; then fail "M-WA6b: WhatsApp compact-QR preload not installed in sandbox (#4522)" else