From a9ec403d216ddeeab83fc0728d3d649846a94d00 Mon Sep 17 00:00:00 2001
From: MistyStar <144589976+Misty-Star@users.noreply.github.com>
Date: Wed, 9 Sep 2026 17:36:22 +0800
Subject: [PATCH] fix: validate pinned Grok explicit roots

---
 scripts/lib/grok-harness-adapter.js    | 14 ++++++++++++--
 tests/lib/grok-harness-adapter.test.js | 14 ++++++++++++++
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/scripts/lib/grok-harness-adapter.js b/scripts/lib/grok-harness-adapter.js
index 11c11b8b2..2c5c101ed 100644
--- a/scripts/lib/grok-harness-adapter.js
+++ b/scripts/lib/grok-harness-adapter.js
@@ -98,6 +98,12 @@ function selectPinnedCachedVersion(versions, sha) {
   return versions.find((entry) => entry.sha === sha) || null;
 }
 
+function isPinnedRoot(root, sha, probe, pathModule = path) {
+  if (!SHA_PATTERN.test(sha || '') || !isCompleteRoot(root, probe, pathModule)) return false;
+  const identity = readJsonIfPresent(pathModule.join(root, SOURCE_IDENTITY_FILE));
+  return Boolean(identity && identity.sha === sha);
+}
+
 function findRootInGrokHome(homeDir, probe, pathModule = path) {
   const grokRoot = grokHomeDir(homeDir, pathModule);
   const candidates = [
@@ -126,13 +132,17 @@ function findRootInGrokHome(homeDir, probe, pathModule = path) {
 function resolveGrokPluginRoot(options = {}) {
   const pathModule = options.pathModule || path;
   if (options.enabled === false) return null;
+  const pinnedSha = options.pinnedSha || (options.source && options.source.sha) || '';
   const envRoot = options.envRoot !== undefined
     ? trimEnv(options.envRoot)
     : grokPluginRootFromEnv(options.env || {});
-  if (envRoot) return envRoot;
+  if (envRoot) {
+    return pinnedSha && !isPinnedRoot(envRoot, pinnedSha, options.probe, pathModule)
+      ? null
+      : envRoot;
+  }
 
   const homeDir = options.homeDir || os.homedir();
-  const pinnedSha = options.pinnedSha || (options.source && options.source.sha) || '';
   if (pinnedSha) {
     const pinned = selectPinnedCachedVersion(listCachedGrokVersions(homeDir, pathModule), pinnedSha);
     if (pinned && isCompleteRoot(pinned.installedRoot, options.probe, pathModule)) {
diff --git a/tests/lib/grok-harness-adapter.test.js b/tests/lib/grok-harness-adapter.test.js
index 0912e9177..429c3a8e2 100644
--- a/tests/lib/grok-harness-adapter.test.js
+++ b/tests/lib/grok-harness-adapter.test.js
@@ -124,6 +124,20 @@ function runTests() {
       writeCompleteRoot(otherCachedRoot, otherSha);
       const cachedRoot = path.join(homeDir, '.grok', 'plugins', 'cache', 'ecc', 'affaan-m', '2.2.1');
       writeCompleteRoot(cachedRoot, sha);
+      assert.strictEqual(
+        adapter.resolveGrokPluginRoot({
+          env: { GROK_PLUGIN_ROOT: otherCachedRoot },
+          pinnedSha: sha,
+        }),
+        null
+      );
+      assert.strictEqual(
+        adapter.resolveGrokPluginRoot({
+          env: { GROK_PLUGIN_ROOT: cachedRoot },
+          pinnedSha: sha,
+        }),
+        cachedRoot
+      );
       assert.strictEqual(adapter.listCachedGrokVersions(homeDir).length, 2);
       assert.strictEqual(adapter.selectPinnedCachedVersion(adapter.listCachedGrokVersions(homeDir), sha).installedRoot, cachedRoot);
       assert.strictEqual(adapter.resolveGrokPluginRoot({ homeDir, pinnedSha: sha }), cachedRoot);