105 lines
3.2 KiB
Python
105 lines
3.2 KiB
Python
from pathlib import Path
|
|
|
|
from hqt import sandbox
|
|
from hqt.sandbox import Bind, SandboxPolicy
|
|
|
|
|
|
def test_bind_defaults_readonly():
|
|
b = Bind(Path("/home/u/.claude"))
|
|
assert b.src == Path("/home/u/.claude")
|
|
assert b.writable is False
|
|
|
|
|
|
def test_sandbox_policy_fields():
|
|
p = SandboxPolicy(fs="rw", net=True)
|
|
assert p.fs == "rw"
|
|
assert p.net is True
|
|
|
|
|
|
def test_is_available_true_on_linux_with_bwrap(monkeypatch):
|
|
monkeypatch.setattr(sandbox.sys, "platform", "linux")
|
|
monkeypatch.setattr(sandbox.shutil, "which", lambda name: "/usr/bin/bwrap")
|
|
assert sandbox.is_available() is True
|
|
|
|
|
|
def test_is_available_false_without_bwrap(monkeypatch):
|
|
monkeypatch.setattr(sandbox.sys, "platform", "linux")
|
|
monkeypatch.setattr(sandbox.shutil, "which", lambda name: None)
|
|
assert sandbox.is_available() is False
|
|
|
|
|
|
def test_is_available_false_off_linux(monkeypatch):
|
|
monkeypatch.setattr(sandbox.sys, "platform", "darwin")
|
|
monkeypatch.setattr(sandbox.shutil, "which", lambda name: "/usr/bin/bwrap")
|
|
assert sandbox.is_available() is False
|
|
|
|
|
|
def _split(args, flag):
|
|
"""Return list of (src, dst) pairs that follow each occurrence of flag."""
|
|
out = []
|
|
for i, a in enumerate(args):
|
|
if a == flag:
|
|
out.append((args[i + 1], args[i + 2]))
|
|
return out
|
|
|
|
|
|
def test_wrap_command_after_double_dash(tmp_path):
|
|
cmd = ["claude", "--session-id", "x"]
|
|
args = sandbox.wrap(cmd, tmp_path, SandboxPolicy(fs="rw", net=True), [])
|
|
assert args[0] == "bwrap"
|
|
assert "--" in args
|
|
assert args[args.index("--") + 1 :] == cmd
|
|
|
|
|
|
def test_wrap_base_flags(tmp_path):
|
|
args = sandbox.wrap(["sh"], tmp_path, SandboxPolicy(fs="rw", net=True), [])
|
|
assert "--die-with-parent" in args
|
|
assert "--unshare-all" in args
|
|
assert "--proc" in args and "--dev" in args
|
|
|
|
|
|
def test_wrap_net_on_shares_net(tmp_path):
|
|
args = sandbox.wrap(["sh"], tmp_path, SandboxPolicy(fs="rw", net=True), [])
|
|
assert "--share-net" in args
|
|
|
|
|
|
def test_wrap_net_off_does_not_share(tmp_path):
|
|
args = sandbox.wrap(["sh"], tmp_path, SandboxPolicy(fs="rw", net=False), [])
|
|
assert "--share-net" not in args
|
|
|
|
|
|
def test_wrap_cwd_rw_is_bind(tmp_path):
|
|
args = sandbox.wrap(["sh"], tmp_path, SandboxPolicy(fs="rw", net=True), [])
|
|
assert (str(tmp_path), str(tmp_path)) in _split(args, "--bind")
|
|
|
|
|
|
def test_wrap_cwd_ro_is_ro_bind(tmp_path):
|
|
args = sandbox.wrap(["sh"], tmp_path, SandboxPolicy(fs="ro", net=True), [])
|
|
assert (str(tmp_path), str(tmp_path)) in _split(args, "--ro-bind")
|
|
|
|
|
|
def test_wrap_writable_bind_spliced(tmp_path):
|
|
cred = tmp_path / "cred"
|
|
cred.mkdir()
|
|
args = sandbox.wrap(
|
|
["sh"], tmp_path, SandboxPolicy(fs="rw", net=True), [Bind(cred, writable=True)]
|
|
)
|
|
assert (str(cred), str(cred)) in _split(args, "--bind")
|
|
|
|
|
|
def test_wrap_readonly_bind_spliced(tmp_path):
|
|
cred = tmp_path / "cred"
|
|
cred.mkdir()
|
|
args = sandbox.wrap(
|
|
["sh"], tmp_path, SandboxPolicy(fs="rw", net=True), [Bind(cred)]
|
|
)
|
|
assert (str(cred), str(cred)) in _split(args, "--ro-bind")
|
|
|
|
|
|
def test_wrap_skips_missing_binds(tmp_path):
|
|
missing = tmp_path / "nope"
|
|
args = sandbox.wrap(
|
|
["sh"], tmp_path, SandboxPolicy(fs="rw", net=True), [Bind(missing)]
|
|
)
|
|
assert str(missing) not in args
|