name the sandbox's working directory, and drive phases through it
Two features, one shared reason: what the sandbox calls things decides what a run tells you afterwards. The cwd is now mounted at the path it has on the host and that is the working directory, so pwd, an error the agent quotes, a commit message and the window title a harness derives from the cwd all name this project instead of reading the same as every sandbox in the session. The mount is unchanged: same directory, same rw, same :z, still the only writable one. Only the destination changed, and a destination is where a bind mount can do damage -- it hides whatever the image already had there. So mirror_block_of() refuses the paths the image or the sandbox owns (/usr, /etc, /var, /opt, /bin, /sbin, /lib*, /boot, /proc, /sys, /dev, /root, /run, /tmp, /home, /home/sandbox*) and / itself, while /home/<user>/... mirrors: the one standard hierarchy where work lives, and the one whose per-user tree never meets the container's /home/sandbox volume or the read-only .agents share inside it. /tmp is what set the shape, and it was measured rather than assumed: with --tmpfs /tmp and -v /tmp/x:/tmp/x in one run podman puts the tmpfs on top, so pwd prints the right path, writes succeed, and the project is not there. A failure that quiet earns a refusal plus a line of output instead: workdir_note in --print-policy, a comment in --dry-run, one log line on a real run. --workdir DIR still chooses the mount point; onto a refused path it is honoured (it was asked for) and warned about. /project, the one directory baked into the image, is every fallback, so a workdir always exists -- --no-cwd included. ai-sandbox-autophase runs a .agents/phases/ pipeline with the split the sandbox forces: every executor agent and the .agents/validate.sh gate inside, the commits and the pushes outside. The gate is in the writable mount, so running it on the host is running agent-editable bash on the host; the git remote is deliberately unreachable in there, because an agent that can push can ship what you are about to review. It runs your launcher, not a copy of it -- the definition is read out of your rc files and never called, which is what lets --status and --dry-run promise no token fetch, no build, no container. Host git runs with an empty hooks path and no ext:: transport, and delivery is refused if a sandboxed unit rewrote .git/config or planted a hook. Needs --no-interactive to go with --no-tty: an unattended run must not leave stdin open on your keyboard, and the two are now separate choices on both sides. Tests and tooling, most of it forced by what the two changes exposed: mirror_block_of is extracted from the script and asked about /usr and /home/sandbox, which a test cannot create (the 06_entrypoint.sh pattern), and both real branches are driven from a scratch dir under $HOME, since $TMPDIR is always the fallback -- which is why the whole suite had only ever seen /project. e2e/12 holds a real container to the same promise, including that /project, /home/sandbox and a home-volume marker survive a mirrored run. The "nothing was started" checks now compare the set of container ids before and after instead of counting every sandbox on the machine, so a session you have open is not a test failure; the pty cases fall back to python3 where util-linux's script is not installed. shellcheck covers both programs, the completion file and the fixtures, so the completion builds are word-by-word now, and a colon in the project path is refused with the reason instead of podman's "invalid option type". 558 unit assertions, 719 with e2e; lint and bash -n clean. LLM-Generated: true
This commit is contained in:
+158
-5
@@ -5,6 +5,9 @@ source "$TESTS/lib.sh"
|
||||
PROJ="$WORK/proj"; mkdir -p "$PROJ"; cd "$PROJ" || exit 1
|
||||
export AISB_CONFIG_DIR="$WORK/cfg-empty"; mkdir -p "$AISB_CONFIG_DIR"
|
||||
A="--allow example.com"
|
||||
# Every run in this file is a preview. What that is worth is asserted at the end, against
|
||||
# the set of containers that existed before it started.
|
||||
snapshot_containers
|
||||
|
||||
t_name "isolation flags are always on"
|
||||
sb --dry-run $A
|
||||
@@ -36,12 +39,15 @@ sb --dry-run $A --no-gate
|
||||
assert_absent "HTTP_PROXY=" "--no-gate sets no proxy"
|
||||
|
||||
t_name "filesystem"
|
||||
# Where the cwd lands depends on the host path, so the expected destination is asked of
|
||||
# the same function the script uses instead of being hardcoded here.
|
||||
PROJ_DEST="$([[ -n "$(mirror_block_of "$PROJ")" ]] && echo /project || echo "$PROJ")"
|
||||
sb --dry-run $A
|
||||
assert_contains "$PROJ:/project" "cwd is mounted at /project"
|
||||
assert_contains "--workdir /project" "cwd is the working directory"
|
||||
assert_contains "$PROJ:$PROJ_DEST" "cwd is mounted at its own path or the fallback"
|
||||
assert_contains "--workdir $PROJ_DEST" "cwd is the working directory"
|
||||
assert_contains "/run/aisb:ro" "policy dir is mounted read-only"
|
||||
sb --dry-run $A --no-cwd
|
||||
assert_absent "$PROJ:/project" "--no-cwd mounts nothing"
|
||||
assert_absent "$PROJ" "--no-cwd mounts nothing"
|
||||
sb --dry-run $A --workdir /src
|
||||
assert_contains "$PROJ:/src" "--workdir changes the mount point"
|
||||
mkdir -p "$WORK/extra"
|
||||
@@ -58,6 +64,119 @@ sb --dry-run $A --ephemeral-home
|
||||
assert_contains "/home/sandbox:rw,nosuid,nodev" "--ephemeral-home uses a tmpfs home"
|
||||
assert_absent "type=volume,source=aisb-home" "--ephemeral-home drops the volume"
|
||||
|
||||
t_name "the container names the directory what the host calls it"
|
||||
# Mirroring the host path is what makes pwd, an error message and a harness' window title
|
||||
# name *this* project. It is a decision about the host path, so both branches need a real
|
||||
# directory: $TMPDIR is a path the sandbox owns, a per-user tree is not.
|
||||
mirrorable_dir || true
|
||||
MIRROR_DIR="$USER_MIRROR_DIR"
|
||||
if [[ -z "$MIRROR_DIR" ]]; then
|
||||
_ok "no writable host path here may be mirrored ($HOME is itself inside a sandbox?) -- skipped"
|
||||
else
|
||||
cd "$MIRROR_DIR" || exit 1
|
||||
sb --dry-run $A
|
||||
assert_contains "$MIRROR_DIR:$MIRROR_DIR" "the cwd is mounted at the path it has on the host"
|
||||
assert_contains "--workdir $MIRROR_DIR" "and worked in at that path"
|
||||
assert_absent "# workdir:" "nothing to announce when the path mirrors"
|
||||
sb --dry-run $A --print-policy
|
||||
assert_eq "" "$(printf '%s' "$OUT" | grep '^workdir_note=' || true)" "and no note in the policy"
|
||||
sb --dry-run $A --workdir /src
|
||||
assert_contains "$MIRROR_DIR:/src" "--workdir still picks the mount point over mirroring"
|
||||
assert_contains "--workdir /src" "--workdir is what reaches podman"
|
||||
sb --dry-run $A --workdir auto
|
||||
assert_contains "--workdir $MIRROR_DIR" "'auto' is the default, spelled out"
|
||||
cd "$PROJ" || exit 1
|
||||
fi
|
||||
|
||||
t_name "a host path the sandbox owns is not mirrored, and says so"
|
||||
# /tmp is the guaranteed case: the sandbox mounts a tmpfs there, and podman puts that
|
||||
# tmpfs on top of a bind of the same path -- so a mirrored /tmp project would come out as
|
||||
# an empty tmpfs. Measured, see docs/networking.md.
|
||||
cd /tmp || exit 1
|
||||
sb --dry-run $A
|
||||
assert_contains "--workdir /project" "/tmp falls back to the image's own directory"
|
||||
assert_contains "-v /tmp:/project" "and mounts the cwd there instead"
|
||||
assert_contains "# workdir: cannot mirror /tmp" "--dry-run explains the fallback"
|
||||
assert_contains "the sandbox owns /tmp*" "naming what it would have buried"
|
||||
assert_contains "--workdir DIR to choose" "and the way to decide otherwise"
|
||||
sb_env AI_API_TOKEN=canary-not-a-real-token --dry-run $A --env AI_API_TOKEN
|
||||
assert_absent "canary-not-a-real-token" "the note carries no values, only the decision"
|
||||
sb --dry-run $A --print-policy
|
||||
assert_contains "workdir=/project" "the policy says which directory was chosen"
|
||||
assert_contains "workdir_note=" "and why"
|
||||
assert_contains "cwd=/tmp" "while still printing the host path"
|
||||
cd "$PROJ" || exit 1
|
||||
|
||||
t_name "which host paths may be mirrored is a decision about the container's filesystem"
|
||||
# The refusals are about what lives at a path *inside* the image, and a test cannot create
|
||||
# /usr or /home/sandbox. So ask the function itself, extracted from the script, about the
|
||||
# paths it was written for -- the same trick 06_entrypoint.sh uses for the entrypoint.
|
||||
[[ -n "$(aisb_fn mirror_block_of)" ]] \
|
||||
&& _ok "the mirror decision is one function in the script" \
|
||||
|| _bad "the mirror decision is one function in the script"
|
||||
# Blocked: everything the base image owns, plus this sandbox's own mounts and home.
|
||||
for p in / /usr/src/proj /var/lib/pg/data /opt/stack/app /etc/proj /tmp/build/proj \
|
||||
/run/user/1000/proj /home /home/sandbox /home/sandbox/work /bin/proj /boot/efi \
|
||||
/dev/shm/x /lib/x86_64-linux-gnu /lib32/x /lib64/ld /proc/1/cwd /root/proj \
|
||||
/sbin/init /sys/firmware; do
|
||||
b="$(mirror_block_of "$p")"
|
||||
if [[ -n "$b" ]]; then _ok "$p is not mirrored (would bury $b)"
|
||||
else _bad "$p is not mirrored" "it was mirrored"; fi
|
||||
done
|
||||
assert_eq "/tmp" "$(mirror_block_of /tmp/a/b)" "the note names the top-level path, not the project"
|
||||
assert_eq "/home/sandbox" "$(mirror_block_of /home/sandbox/work)" "the container home is named as itself"
|
||||
assert_eq "/" "$(mirror_block_of /)" "the whole root is refused"
|
||||
# Free: per-user trees under /home, and the hierarchy the image leaves empty.
|
||||
for p in /home/you/Projects/foo /home/dev /home/sandboxer/proj /mnt/data/proj /srv/www \
|
||||
/media/usb/proj /code/x /work/proj /data/proj /home/sandboxish/x; do
|
||||
b="$(mirror_block_of "$p")"
|
||||
if [[ -z "$b" ]]; then _ok "$p mirrors to itself"
|
||||
else _bad "$p mirrors to itself" "refused because of $b"; fi
|
||||
done
|
||||
|
||||
t_name "a project path podman cannot express is refused with a reason"
|
||||
# Measured: podman answers `-v /a:b:/project` with `invalid option type "/project"`, which
|
||||
# is a strange thing to read when all you typed was `pi`. Mirroring puts the same string in
|
||||
# the destination too, so it is refused before podman is involved.
|
||||
COLON="$WORK/a:b"; mkdir -p "$COLON"; cd "$COLON" || exit 1
|
||||
sb --dry-run $A
|
||||
assert_rc 1 "a ':' in the project path is refused"
|
||||
assert_contains "podman cannot parse" "and says whose parser"
|
||||
assert_contains "--no-cwd" "and names the way out"
|
||||
sb --dry-run $A --no-cwd
|
||||
assert_rc 0 "--no-cwd needs nothing mounted, so the path is fine"
|
||||
cd "$PROJ" || exit 1
|
||||
|
||||
t_name "--workdir takes a container path or 'auto', nothing else"
|
||||
sb --dry-run $A --workdir relative/dir
|
||||
assert_rc 1 "a relative --workdir is refused"
|
||||
assert_contains "must be an absolute path or 'auto'" "and says what it wanted"
|
||||
sb --dry-run $A --workdir /
|
||||
assert_rc 1 "--workdir / is refused"
|
||||
assert_contains "over the whole container" "with the reason"
|
||||
sb --dry-run $A --workdir /src/
|
||||
assert_contains "$PROJ:/src" "a trailing slash is not part of the destination"
|
||||
# An explicit path onto something the sandbox owns is honoured -- it was asked for -- but
|
||||
# the hiding rule does not stop applying because a human chose the path, so it is warned.
|
||||
sb --dry-run $A --workdir /tmp/proj
|
||||
assert_rc 0 "--workdir onto a path the sandbox owns is still honoured"
|
||||
assert_contains "$PROJ:/tmp/proj" "podman is told what was asked for"
|
||||
assert_contains "warning: --workdir /tmp/proj" "and the covering is announced"
|
||||
assert_contains "/tmp is a tmpfs" "with the reason"
|
||||
sb --dry-run $A --workdir /opt/proj
|
||||
assert_contains "the sandbox owns /opt*" "the same for a directory the image owns"
|
||||
sb --dry-run $A --workdir /srv/app
|
||||
assert_absent "warning: --workdir" "a path nothing owns is chosen in silence"
|
||||
sb_env AISB_PROJECT_DEST=/srv/app --dry-run $A
|
||||
assert_contains "$PROJ:/srv/app" "AISB_PROJECT_DEST still chooses it"
|
||||
mkdir -p "$WORK/cfg-wd"
|
||||
printf 'workdir = /srv/cfg\n' > "$WORK/cfg-wd/config"
|
||||
# No subshell here: OUT and the counters have to survive it.
|
||||
AISB_CONFIG_DIR_SAVED="$AISB_CONFIG_DIR"; export AISB_CONFIG_DIR="$WORK/cfg-wd"
|
||||
sb --dry-run $A
|
||||
assert_contains "$PROJ:/srv/cfg" "the config file chooses it too"
|
||||
export AISB_CONFIG_DIR="$AISB_CONFIG_DIR_SAVED"
|
||||
|
||||
t_name "labels, limits, extra args"
|
||||
sb --dry-run $A --label team=x
|
||||
assert_contains "--label team=x" "--label"
|
||||
@@ -80,7 +199,41 @@ if [[ -n "$pos_cmd" && -n "$pos_img" && $pos_img -lt $pos_cmd ]]; then _ok "the
|
||||
|
||||
t_name "dry run is side-effect free"
|
||||
sb --dry-run $A
|
||||
RUNNING="$(podman ps --format '{{.Names}}' | grep -c 'aisb' || true)"
|
||||
# Ask about the container *this* invocation would have created, not about every sandbox on
|
||||
# the machine: another session that happens to be running is not this test starting one.
|
||||
# The session id is unique per run, so its label is the hermetic question.
|
||||
SID="$(printf '%s' "$OUT" | tr ' ' '\n' | sed -n 's/^aisb\.session=//p' | head -1)"
|
||||
[[ -n "$SID" ]] && _ok "the dry run names its session" || _bad "the dry run names its session"
|
||||
CREATED="$(podman ps -a --filter "label=aisb.session=$SID" --format '{{.Names}}' | wc -l | tr -d ' ')"
|
||||
DIRS="$(ls -A "$AISB_STATE_DIR/sessions" 2>/dev/null | wc -l | tr -d ' ')"
|
||||
assert_eq "$RUNNING" 0 "dry run started no container"
|
||||
assert_eq "$CREATED" 0 "dry run created no container, under any name"
|
||||
assert_eq "$DIRS" 0 "dry run left no session directory behind"
|
||||
assert_no_new_containers "and no preview in this file created one either"
|
||||
|
||||
t_name "attachment: stdin is a choice, and an unattended run does not want it"
|
||||
# -t and -i are decided from the real stdin/stdout, and the test runner's are pipes. The
|
||||
# pipe case is checked either way; the attached case needs a pty, which lib.sh builds from
|
||||
# 'script' or python3 and reports as skipped when the host has neither.
|
||||
inv_line() { printf '%s' "$OUT" | tr -d '\r' | tail -1; }
|
||||
has_opt() { inv_line | grep -qE "(^| )$1( |$)"; }
|
||||
sb_pty() { pty_run "$AISB" --dry-run --net none "$@"; }
|
||||
sb --dry-run --net none
|
||||
if has_opt "-i" || has_opt "-t"; then _bad "pipes get neither" "$(inv_line)"; else _ok "pipes get neither: nothing is attached to a terminal that is not there"; fi
|
||||
sb --dry-run --net none --interactive
|
||||
if has_opt "-i"; then _ok "--interactive still forces it on with pipes"; else _bad "--interactive still forces it on with pipes" "$(inv_line)"; fi
|
||||
if ! pty_available; then
|
||||
_ok "neither 'script' nor python3 here -- the attached cases are skipped"
|
||||
else
|
||||
sb_pty
|
||||
assert_rc 0 "on a pty"
|
||||
if has_opt "-i" && has_opt "-t"; then _ok "a terminal run is attached, which is what an interactive shell expects"; else _bad "a terminal run is attached" "$(inv_line)"; fi
|
||||
sb_pty --no-interactive
|
||||
assert_rc 0 "--no-interactive"
|
||||
if has_opt "-i"; then _bad "--no-interactive drops -i" "$(inv_line)"; else _ok "--no-interactive drops -i: the command cannot read this terminal"; fi
|
||||
if has_opt "-t"; then _ok "--no-interactive leaves the TTY alone (it is a separate choice)"; else _bad "--no-interactive leaves the TTY alone" "$(inv_line)"; fi
|
||||
sb_pty --no-tty --no-interactive
|
||||
if has_opt "-t" || has_opt "-i"; then _bad "--no-tty --no-interactive detaches both" "$(inv_line)"; else _ok "--no-tty --no-interactive detaches both"; fi
|
||||
sb_pty --strict-args --no-interactive
|
||||
assert_rc 0 "--no-interactive is a real flag, not a pass-through to the harness"
|
||||
if has_opt "-i"; then _bad "--no-interactive is parsed, not forwarded" "$(inv_line)"; else _ok "--no-interactive is parsed, not forwarded"; fi
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user