From bd9286a39fb25a2b88d4a54f553a21f84024600e Mon Sep 17 00:00:00 2001
From: agentson <agentson@localhost>
Date: Mon, 2 Mar 2026 18:32:07 +0900
Subject: [PATCH] fix: require executable tea fallback binary (#392)

---
 scripts/validate_pr_body.py    |  5 +++--
 tests/test_validate_pr_body.py | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/scripts/validate_pr_body.py b/scripts/validate_pr_body.py
index 8800517..2d6ae4d 100644
--- a/scripts/validate_pr_body.py
+++ b/scripts/validate_pr_body.py
@@ -5,6 +5,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
 import shutil
 import re
 import subprocess
@@ -28,7 +29,7 @@ def resolve_tea_binary() -> str:
         return tea_from_path
 
     tea_home = Path.home() / "bin" / "tea"
-    if tea_home.exists():
+    if tea_home.exists() and tea_home.is_file() and os.access(tea_home, os.X_OK):
         return str(tea_home)
 
     raise RuntimeError("tea binary not found (checked PATH and ~/bin/tea)")
@@ -63,7 +64,7 @@ def fetch_pr_body(pr_number: int) -> str:
             capture_output=True,
             text=True,
         )
-    except (subprocess.CalledProcessError, FileNotFoundError) as exc:
+    except (subprocess.CalledProcessError, FileNotFoundError, PermissionError) as exc:
         raise RuntimeError(f"failed to fetch PR #{pr_number}: {exc}") from exc
 
     try:
diff --git a/tests/test_validate_pr_body.py b/tests/test_validate_pr_body.py
index 1d4f2ca..f6c7b21 100644
--- a/tests/test_validate_pr_body.py
+++ b/tests/test_validate_pr_body.py
@@ -106,7 +106,21 @@ def test_resolve_tea_binary_falls_back_to_home_bin(monkeypatch, tmp_path) -> Non
     tea_home = tmp_path / "bin" / "tea"
     tea_home.parent.mkdir(parents=True)
     tea_home.write_text("#!/usr/bin/env bash\n", encoding="utf-8")
+    tea_home.chmod(0o755)
 
     monkeypatch.setattr(module.shutil, "which", lambda _: None)
     monkeypatch.setattr(module.Path, "home", lambda: tmp_path)
     assert module.resolve_tea_binary() == str(tea_home)
+
+
+def test_resolve_tea_binary_rejects_non_executable_home_bin(monkeypatch, tmp_path) -> None:
+    module = _load_module()
+    tea_home = tmp_path / "bin" / "tea"
+    tea_home.parent.mkdir(parents=True)
+    tea_home.write_text("not executable\n", encoding="utf-8")
+    tea_home.chmod(0o644)
+
+    monkeypatch.setattr(module.shutil, "which", lambda _: None)
+    monkeypatch.setattr(module.Path, "home", lambda: tmp_path)
+    with pytest.raises(RuntimeError):
+        module.resolve_tea_binary()