Added the guarded, one-shot monero:pilot-address command

tests/pilot-monero-deposit.test.ts

@@ -1,6 +1,10 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { chmod, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { loadPilotMoneroDepositRequestFile } from '../server/market/pilot-monero-deposit-request-file.ts';
 
 function run(code: string) {
   return JSON.parse(execFileSync(process.execPath, ['--experimental-strip-types', '--input-type=module', '-e', code], {
@@ -74,3 +78,30 @@ test('pilot deposit authorization rejects malformed and unknown fields', () => {
     console.log(JSON.stringify({malformed,unknown}));`);
   assert.deepEqual(result, { malformed: true, unknown: true });
 });
+
+test('operator address CLI requires explicit consent before reading wallet or database configuration', () => {
+  const result = spawnSync(process.execPath, ['--experimental-strip-types', 'scripts/pilot-monero-deposit-address.ts', '/missing/request.json'], {
+    cwd: process.cwd(), encoding: 'utf8', timeout: 30_000,
+    env: { ...process.env, WIKIDECK_NETWORK: 'pilot', WIKIDECK_PILOT_MODE: 'private-mock-only',
+      WIKIDECK_PILOT_CUSTODY_OPERATIONS: '' },
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /operator-triggered-addresses-only/);
+  assert.doesNotMatch(result.stderr, /database configuration|Wallet-RPC config/);
+});
+
+test('signed pilot request files must be absolute, bounded, owner-only regular files', async t => {
+  if (process.platform === 'win32') {
+    await assert.rejects(loadPilotMoneroDepositRequestFile('C:\\private\\request.json'), /POSIX protected-file/);
+    return;
+  }
+  const directory = await mkdtemp(join(tmpdir(), 'wikideck-pilot-address-request-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const path = join(directory, 'request.json');
+  await writeFile(path, JSON.stringify({ version: 1, signature: 'signed-fixture' }), { mode: 0o600 });
+  await chmod(path, 0o600);
+  assert.deepEqual(await loadPilotMoneroDepositRequestFile(path), { version: 1, signature: 'signed-fixture' });
+  await chmod(path, 0o644);
+  await assert.rejects(loadPilotMoneroDepositRequestFile(path), /owner-only/);
+  await assert.rejects(loadPilotMoneroDepositRequestFile('relative.json'), /absolute/);
+});