fix(weixin): show allowed image directories - #5296

@qwen-code /triage

@qwen-code /triage

✅ Local runtime verification (real tmux, no mocks) — PR #5296

Verdict: works as intended, no regressions — safe to merge.

I reproduced the issue #4441 rejection path against the real validateImagePath — real filesystem, real node:fs/node:os/node:path, no test doubles — running both the compiled dist/send.js (the shipped artifact) and the TypeScript source, inside an isolated tmux session.

What the PR does

When an image is rejected as outside the sandbox allowlist, the error message now also lists the allowed directories. formatAllowedImageDirs dedupes the four internal /tmp-style entries and trims trailing separators; trimDisplayDir preserves Windows drive roots (C:\). The allowlist enforcement itself is unchanged.

Evidence

1. Unit suite + build (PR head)

Test Files  2 passed (2)
     Tests  45 passed (45)     # src/send.test.ts 34 (incl. the new one) + media 11
VITEST_EXIT=0
npm run build  →  tsc --build  →  BUILD_EXIT=0
dist/send.js rebuilt 2026-06-19 02:41, contains "Allowed directories" ✓

2. Real runtime — PR head (identical result against compiled dist and source):

[A outside-allowed-dirs] THROW  -> Image path outside allowed directories: .../outside/hello.png. Allowed directories: /tmp, .../workspace
[B inside-workspace    ] OK     -> returned: .../workspace/inside.png
[C inside-/tmp         ] OK     -> returned: /tmp/realtest5296.png
HAS_ALLOWED_DIRS_HINT=true   LISTS_TMP=true   LISTS_WORKSPACE=true   NO_TRAILING_SLASH=true

Full message verbatim:

Image path outside allowed directories: /root/realtest-5296/fs/outside/hello.png. Allowed directories: /tmp, /root/realtest-5296/fs/workspace

On this host os.tmpdir() is /tmp, so all four /tmp-style allowlist entries collapse to a single /tmp via the new dedup, and the workspace is shown without a trailing slash. The happy paths (inside workspace, inside /tmp) still validate — no regression.

3. A/B against the pre-PR base commit (same harness, same filesystem):

[A outside-allowed-dirs] THROW  -> Image path outside allowed directories: .../outside/hello.png
HAS_ALLOWED_DIRS_HINT=false

Direct before/after: base emits the bare message (exactly the #4441 complaint); head appends the directory list.

4. The new test has teeth — running the PR's regression test against the base code fails as expected:

× validateImagePath > reports the allowed directories when a Windows image path is rejected
  Expected: "...hello.png. Allowed directories: /tmp, D:\OtherProject"
  Received: "...hello.png"
TEETH_VITEST_EXIT=1

Edge cases checked (against the exact helper logic)

Minor / non-blocking nit: a workspace that is literally a drive root is built internally as C:\/ and then displays as C: (cosmetic only; unreachable in normal use because tmpdir()/cwd are never bare drive roots).

Notes

• True Windows path semantics are exercised only via mocked realpathSync in the unit test — expected on a Linux host. The win32 branch is unit-covered and the new test pins the exact string /tmp, D:\OtherProject.
• After the A/B swap, the working tree was restored to head and verified clean (RESTORE_CLEAN=yes).

Test Files  2 passed (2)
     Tests  45 passed (45)     # send.test.ts 34 个（含新增用例）+ media 11 个
VITEST_EXIT=0
npm run build  →  tsc --build  →  BUILD_EXIT=0
dist/send.js 于 2026-06-19 02:41 重新生成，包含 "Allowed directories" ✓

[A outside-allowed-dirs] THROW  -> Image path outside allowed directories: .../outside/hello.png. Allowed directories: /tmp, .../workspace
[B inside-workspace    ] OK     -> returned: .../workspace/inside.png
[C inside-/tmp         ] OK     -> returned: /tmp/realtest5296.png
HAS_ALLOWED_DIRS_HINT=true   LISTS_TMP=true   LISTS_WORKSPACE=true   NO_TRAILING_SLASH=true

[A outside-allowed-dirs] THROW  -> Image path outside allowed directories: .../outside/hello.png
HAS_ALLOWED_DIRS_HINT=false

× validateImagePath > reports the allowed directories when a Windows image path is rejected
  Expected: "...hello.png. Allowed directories: /tmp, D:\OtherProject"
  Received: "...hello.png"
TEETH_VITEST_EXIT=1