fix: require executable tea fallback binary (#392)

scripts/validate_pr_body.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
 import shutil
 import re
 import subprocess
@@ -28,7 +29,7 @@ def resolve_tea_binary() -> str:
         return tea_from_path
 
     tea_home = Path.home() / "bin" / "tea"
-    if tea_home.exists():
+    if tea_home.exists() and tea_home.is_file() and os.access(tea_home, os.X_OK):
         return str(tea_home)
 
     raise RuntimeError("tea binary not found (checked PATH and ~/bin/tea)")
@@ -63,7 +64,7 @@ def fetch_pr_body(pr_number: int) -> str:
             capture_output=True,
             text=True,
         )
-    except (subprocess.CalledProcessError, FileNotFoundError) as exc:
+    except (subprocess.CalledProcessError, FileNotFoundError, PermissionError) as exc:
         raise RuntimeError(f"failed to fetch PR #{pr_number}: {exc}") from exc
 
     try:

tests/test_validate_pr_body.py

@@ -106,7 +106,21 @@ def test_resolve_tea_binary_falls_back_to_home_bin(monkeypatch, tmp_path) -> Non
     tea_home = tmp_path / "bin" / "tea"
     tea_home.parent.mkdir(parents=True)
     tea_home.write_text("#!/usr/bin/env bash\n", encoding="utf-8")
+    tea_home.chmod(0o755)
 
     monkeypatch.setattr(module.shutil, "which", lambda _: None)
     monkeypatch.setattr(module.Path, "home", lambda: tmp_path)
     assert module.resolve_tea_binary() == str(tea_home)
+
+
+def test_resolve_tea_binary_rejects_non_executable_home_bin(monkeypatch, tmp_path) -> None:
+    module = _load_module()
+    tea_home = tmp_path / "bin" / "tea"
+    tea_home.parent.mkdir(parents=True)
+    tea_home.write_text("not executable\n", encoding="utf-8")
+    tea_home.chmod(0o644)
+
+    monkeypatch.setattr(module.shutil, "which", lambda _: None)
+    monkeypatch.setattr(module.Path, "home", lambda: tmp_path)
+    with pytest.raises(RuntimeError):
+        module.resolve_tea_binary()