Merge branch 'sandboxed-sessions'

tests/test_db.py

@@ -98,6 +98,7 @@ def test_unversioned_existing_db_stamped_latest(tmp_path):
         conn.exec_driver_sql("DROP TABLE scheduled_prompts")
         conn.exec_driver_sql("ALTER TABLE sessions DROP COLUMN worktree_path")
         conn.exec_driver_sql("ALTER TABLE sessions DROP COLUMN worktree_branch")
+        conn.exec_driver_sql("ALTER TABLE sessions DROP COLUMN sandbox_json")
     migrate(engine)
     assert _user_version(engine) == migrations.LATEST_VERSION
 
@@ -117,22 +118,23 @@ def test_pending_migrations_applied_in_order_once(tmp_path, monkeypatch):
     ensure_db(settings)  # stamps migrations.LATEST_VERSION
     applied: list[int] = []
     # Use versions above current LATEST_VERSION so none have been applied yet.
+    next_version = migrations.LATEST_VERSION + 1
     monkeypatch.setattr(
         migrations,
         "MIGRATIONS",
         [
             *migrations.MIGRATIONS,
-            (4, lambda conn: applied.append(4)),
-            (5, lambda conn: applied.append(5)),
+            (next_version, lambda conn: applied.append(next_version)),
+            (next_version + 1, lambda conn: applied.append(next_version + 1)),
         ],
     )
-    monkeypatch.setattr(migrations, "LATEST_VERSION", 5)
+    monkeypatch.setattr(migrations, "LATEST_VERSION", next_version + 1)
     engine = get_engine(settings)
     migrate(engine)
-    assert applied == [4, 5]
-    assert _user_version(engine) == 5
+    assert applied == [next_version, next_version + 1]
+    assert _user_version(engine) == next_version + 1
     migrate(engine)  # re-run is a no-op
-    assert applied == [4, 5]
+    assert applied == [next_version, next_version + 1]
 
 
 def _session_column_names(engine) -> list[str]:
@@ -154,11 +156,12 @@ def test_fresh_db_has_worktree_columns(tmp_path):
     cols = _session_column_names(engine)
     assert "worktree_path" in cols
     assert "worktree_branch" in cols
+    assert "sandbox_json" in cols
     assert _user_version(engine) == migrations.LATEST_VERSION
 
 
-def test_v1_db_upgraded_to_v2(tmp_path):
-    # Build a v1 database: create all tables, drop the two new columns, stamp v1.
+def test_v1_db_upgraded_to_latest(tmp_path):
+    # Build a v1 database: create all tables, drop v2+ objects, stamp v1.
     settings = _tmp_settings(tmp_path)
     settings.db_path.parent.mkdir(parents=True, exist_ok=True)
     engine = get_engine(settings)
@@ -167,6 +170,7 @@ def test_v1_db_upgraded_to_v2(tmp_path):
         conn.exec_driver_sql("DROP TABLE scheduled_prompts")
         conn.exec_driver_sql("ALTER TABLE sessions DROP COLUMN worktree_path")
         conn.exec_driver_sql("ALTER TABLE sessions DROP COLUMN worktree_branch")
+        conn.exec_driver_sql("ALTER TABLE sessions DROP COLUMN sandbox_json")
         conn.exec_driver_sql("PRAGMA user_version = 1")
 
     migrate(engine)
@@ -174,6 +178,8 @@ def test_v1_db_upgraded_to_v2(tmp_path):
     cols = _session_column_names(engine)
     assert "worktree_path" in cols
     assert "worktree_branch" in cols
+    assert "sandbox_json" in cols
+    assert "scheduled_prompts" in inspect(engine).get_table_names()
     assert _user_version(engine) == migrations.LATEST_VERSION
 
 
@@ -195,22 +201,24 @@ def test_fresh_db_has_scheduled_prompts_table(tmp_path):
         "created_at",
         "sent_at",
     ]
-    assert _user_version(engine) == 3
+    assert _user_version(engine) == migrations.LATEST_VERSION
 
 
-def test_v2_db_upgraded_to_v3_adds_scheduled_prompts(tmp_path):
+def test_v2_db_upgraded_to_latest_adds_scheduled_prompts_and_sandbox(tmp_path):
     settings = _tmp_settings(tmp_path)
     settings.db_path.parent.mkdir(parents=True, exist_ok=True)
     engine = get_engine(settings)
     Base.metadata.create_all(engine)
     with engine.begin() as conn:
         conn.exec_driver_sql("DROP TABLE scheduled_prompts")
+        conn.exec_driver_sql("ALTER TABLE sessions DROP COLUMN sandbox_json")
         conn.exec_driver_sql("PRAGMA user_version = 2")
 
     migrate(engine)
 
     assert "scheduled_prompts" in inspect(engine).get_table_names()
-    assert _user_version(engine) == 3
+    assert "sandbox_json" in _session_column_names(engine)
+    assert _user_version(engine) == migrations.LATEST_VERSION
 
 
 def test_scheduled_prompt_one_row_per_session(tmp_path):
@@ -291,3 +299,45 @@ def test_rows_stay_readable_after_session_closes(tmp_path):
         session.add(p)
         session.commit()
     assert p.name == "x"  # would raise DetachedInstanceError without the flag
+
+
+def test_latest_version_is_four():
+    assert migrations.LATEST_VERSION == 4
+
+
+def test_migration_adds_sandbox_json_column(tmp_path):
+    # Simulate a v3 DB whose sessions table predates the sandbox column.
+    settings = _tmp_settings(tmp_path)
+    settings.db_path.parent.mkdir(parents=True, exist_ok=True)
+    engine = get_engine(settings)
+    with engine.begin() as conn:
+        conn.exec_driver_sql(
+            "CREATE TABLE sessions ("
+            "id INTEGER PRIMARY KEY, project_id INTEGER, harness_id INTEGER, "
+            "tmux_session_name TEXT)"
+        )
+        conn.exec_driver_sql("PRAGMA user_version = 3")
+    migrate(engine)
+    cols = [c["name"] for c in inspect(engine).get_columns("sessions")]
+    assert "sandbox_json" in cols
+    assert _user_version(engine) == migrations.LATEST_VERSION
+
+
+def test_session_round_trips_sandbox_json(tmp_path):
+    settings = _tmp_settings(tmp_path)
+    ensure_db(settings)
+    factory = get_session_factory(get_engine(settings))
+    with factory() as session:
+        p = Project(name="proj", path="/tmp/proj-sandbox")
+        h = Harness(name="claude-sandbox")
+        session.add_all([p, h])
+        session.commit()
+        s = Session(
+            project_id=p.id,
+            harness_id=h.id,
+            tmux_session_name="hqt-9",
+            sandbox_json='{"fs": "rw", "net": true}',
+        )
+        session.add(s)
+        session.commit()
+        assert session.get(Session, s.id).sandbox_json == '{"fs": "rw", "net": true}'