felixm
3130d95cc5
Core sandbox infrastructure for isolating harness sessions. Bind defines read-only/writable path bindings, SandboxPolicy specifies filesystem and network isolation modes, and is_available() is the single source of truth for bubblewrap availability across the application. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
from pathlib import Path
|
|
|
|
from hqt import sandbox
|
|
from hqt.sandbox import Bind, SandboxPolicy
|
|
|
|
|
|
def test_bind_defaults_readonly():
|
|
b = Bind(Path("/home/u/.claude"))
|
|
assert b.src == Path("/home/u/.claude")
|
|
assert b.writable is False
|
|
|
|
|
|
def test_sandbox_policy_fields():
|
|
p = SandboxPolicy(fs="rw", net=True)
|
|
assert p.fs == "rw"
|
|
assert p.net is True
|
|
|
|
|
|
def test_is_available_true_on_linux_with_bwrap(monkeypatch):
|
|
monkeypatch.setattr(sandbox.sys, "platform", "linux")
|
|
monkeypatch.setattr(sandbox.shutil, "which", lambda name: "/usr/bin/bwrap")
|
|
assert sandbox.is_available() is True
|
|
|
|
|
|
def test_is_available_false_without_bwrap(monkeypatch):
|
|
monkeypatch.setattr(sandbox.sys, "platform", "linux")
|
|
monkeypatch.setattr(sandbox.shutil, "which", lambda name: None)
|
|
assert sandbox.is_available() is False
|
|
|
|
|
|
def test_is_available_false_off_linux(monkeypatch):
|
|
monkeypatch.setattr(sandbox.sys, "platform", "darwin")
|
|
monkeypatch.setattr(sandbox.shutil, "which", lambda name: "/usr/bin/bwrap")
|
|
assert sandbox.is_available() is False
|