@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/test/sandbox-driver.test.js

@@ -0,0 +1,553 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  SandboxDriver (PLAN/serve-v4-clean.md §5).
+ *
+ *  The assertions here are the invariants, not the implementation details:
+ *   - routes are STATIC at create; runtime change is revocation only;
+ *   - a driver never pretends to enforce something it cannot (tier 0 per-route revoke throws);
+ *   - the sandbox holds no secret in its environment;
+ *   - the image is pinned by digest;
+ *   - a half-wired sandbox is torn down rather than run.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("node:fs"));
+const net = __importStar(require("node:net"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const node_events_1 = require("node:events");
+const node_stream_1 = require("node:stream");
+const support_1 = require("../sandbox/support");
+const containerDriver_1 = require("../sandbox/containerDriver");
+const processDriver_1 = require("../sandbox/processDriver");
+const types_1 = require("../sandbox/types");
+const host_1 = require("../runner/host");
+const remoteEngine_1 = require("../runner/remoteEngine");
+const IMAGE = 'ghcr.io/agenthippoai/pack@sha256:' + 'a'.repeat(64);
+/** Unit tests must never create directories under the real /run/agenthippo/sandboxes. */
+const TEST_SOCK_DIR = path.join(os.tmpdir(), 'ah-sandbox-tests');
+function spec(over = {}) {
+    return {
+        sessionKey: 'sess-1',
+        image: IMAGE,
+        tier: 2,
+        routes: [
+            { kind: 'data', target: 'connector:9090' },
+            { kind: 'inference', target: 'litellm:4000' },
+        ],
+        fs: { readonly: [], writable: [] },
+        limits: { ttlSeconds: 0 },
+        ...over,
+    };
+}
+/** Records every runtime invocation so tests assert on the actual command line. */
+function fakeExec(overrides = {}) {
+    const calls = [];
+    const exec = async (args) => {
+        calls.push(args);
+        const key = args.slice(0, 2).join(' ');
+        const o = overrides[key];
+        if (o) {
+            return { stdout: o.stdout ?? '', code: o.code ?? 0 };
+        }
+        // `network inspect --format {{.Internal}}` must answer `true` here: these tests assert the
+        // tier-2 claim, and the driver now DOWNGRADES the reported tier when a route network is
+        // NAT'd (see sandbox-hardening.test.ts for that path). A blank answer used to mean
+        // "not internal" and silently made every one of these a tier-1 sandbox.
+        if (args[0] === 'network' && args[1] === 'inspect') {
+            return { stdout: 'true\n', code: 0 };
+        }
+        return { stdout: args[0] === 'run' ? 'container-abc123' : '', code: 0 };
+    };
+    return { calls, exec };
+}
+suite('container driver — the boundary it actually delivers', () => {
+    /**
+     * The in-process data plane and a local LiteLLM are BOTH loopback by default, so this was the
+     * default tier-2 configuration failing at `docker run` with "network agenthippo-127.0.0.1 not
+     * found" — a message about a symptom two layers from the cause.
+     */
+    test('a loopback route is refused with the reason, not a missing-network error', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await assert.rejects(driver.create(spec({ routes: [{ kind: 'inference', target: 'http://127.0.0.1:4000' }] })), /loopback/);
+        await assert.rejects(driver.create(spec({ routes: [{ kind: 'data', target: 'http://localhost:41234/mcp' }] })), /loopback/);
+        assert.ok(!calls.some((c) => c[0] === 'run'), 'refused before any container was created');
+    });
+    test('a route network that does not exist names itself, and no container is created', async () => {
+        const { calls, exec } = fakeExec({ 'network inspect': { code: 1, stdout: '' } });
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await assert.rejects(driver.create(spec()), /route network "agenthippo-connector" .* does not exist/);
+        assert.ok(!calls.some((c) => c[0] === 'run'), 'checked before `docker run`, not after it fails');
+    });
+    test('a route network that is not --internal is disclosed, not silently accepted', async () => {
+        const warnings = [];
+        // An inference route to an external proxy legitimately cannot be internal, so this must
+        // remain a warning: refusing here would forbid the normal deployment shape.
+        const { exec } = fakeExec({ 'network inspect': { code: 0, stdout: 'false' } });
+        const driver = new containerDriver_1.ContainerSandboxDriver({
+            exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0,
+            logger: { info() { }, warn: (m) => warnings.push(m) },
+        });
+        await driver.create(spec());
+        assert.ok(warnings.some((w) => w.includes('is not --internal')), 'operator is told the boundary is topology-dependent');
+    });
+    test('an --internal route network passes without noise', async () => {
+        const warnings = [];
+        const { exec } = fakeExec({ 'network inspect': { code: 0, stdout: 'true' } });
+        const driver = new containerDriver_1.ContainerSandboxDriver({
+            exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0,
+            logger: { info() { }, warn: (m) => warnings.push(m) },
+        });
+        await driver.create(spec());
+        assert.deepStrictEqual(warnings, []);
+    });
+    test('declares tier 2 to the sandbox, and spec.env cannot forge it', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await driver.create(spec({ env: { [types_1.SANDBOX_TIER_ENV]: '0' } }));
+        const run = calls.find((c) => c[0] === 'run');
+        // The driver's own tier is stamped after spec.env, so the LAST occurrence wins in docker
+        // and a caller cannot understate (or overstate) the boundary the container really provides.
+        const tierFlags = run.filter((_a, i) => run[i - 1] === '--env' && run[i].startsWith(`${types_1.SANDBOX_TIER_ENV}=`));
+        assert.strictEqual(tierFlags[tierFlags.length - 1], `${types_1.SANDBOX_TIER_ENV}=2`);
+    });
+    test('default-deny network, dropped caps, read-only fs, socket mount, digest-pinned image', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0 });
+        const handle = await driver.create(spec());
+        const run = calls.find((c) => c[0] === 'run');
+        const line = run.join(' ');
+        // Docker refuses `network connect` on a container created in `none` mode (verified live),
+        // so the first declared route is attached at create and the rest after. Either way the
+        // sandbox never joins the default bridge.
+        assert.ok(line.includes('--network agenthippo-connector'), 'sandbox is created directly on its first declared route network, never the default bridge');
+        assert.ok(line.includes('--cap-drop ALL'), 'capabilities dropped');
+        assert.ok(line.includes('--security-opt no-new-privileges'));
+        assert.ok(line.includes('--read-only'), 'root filesystem is read-only');
+        // A read-only root without a writable /tmp breaks tools that need scratch space —
+        // codex's bubblewrap sandbox panics outright.
+        assert.ok(line.includes('--tmpfs /tmp:rw,exec,nosuid,size=512m'), 'writable tmpfs at /tmp');
+        // One directory per sandbox, mounted at a fixed path inside: docker cannot bind-mount a
+        // socket file that does not exist yet (it would create a directory in its place).
+        assert.ok(line.includes(`--volume /tmp/sandboxes/${handle.id}:/run/sandbox`), 'exactly this sandbox\'s socket directory is mounted — reaching it IS the sandbox identity');
+        assert.strictEqual(handle.tier, 2);
+        assert.strictEqual(handle.endpoint, `/tmp/sandboxes/${handle.id}/sandbox.sock`);
+    });
+    test('attaches exactly the declared routes — one network per role, nothing else', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await driver.create(spec());
+        const runLine = calls.find((c) => c[0] === 'run').join(' ');
+        const connects = calls.filter((c) => c[0] === 'network' && c[1] === 'connect');
+        assert.ok(runLine.includes('--network agenthippo-connector'), 'first route attached at create');
+        assert.strictEqual(connects.length, 1, 'remaining routes attached after; no extras');
+        assert.strictEqual(connects[0][2], 'agenthippo-litellm');
+    });
+    test('a FAILED docker run leaves no container object behind', async () => {
+        const { calls, exec } = fakeExec({ 'run --detach': { code: 125, stdout: 'network not found' } });
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await assert.rejects(driver.create(spec()), /failed to create sandbox/);
+        assert.ok(calls.some((c) => c[0] === 'rm' && c.includes('--force')), 'the half-created container is swept, or its name stays taken and every retry fails');
+    });
+    test('a sandbox with no declared routes gets no network at all', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await driver.create(spec({ routes: [] }));
+        const line = calls.find((c) => c[0] === 'run').join(' ');
+        assert.ok(line.includes('--network none'), 'no routes ⇒ no network');
+        assert.ok(!calls.some((c) => c[0] === 'network' && c[1] === 'connect'));
+    });
+    test('a route that fails to attach tears the sandbox down — never run half-wired', async () => {
+        const { calls, exec } = fakeExec({ 'network connect': { code: 1, stdout: 'no such network' } });
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        // The first route rides `docker run`; this exercises a LATER route failing to attach.
+        await assert.rejects(driver.create(spec()), /failed to attach inference route/);
+        assert.ok(calls.some((c) => c[0] === 'rm' && c.includes('--force')), 'the partially-wired container is removed, not left running');
+    });
+    test('revoke detaches exactly one route and leaves the others intact (non-cooperative cap enforcement)', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        const handle = await driver.create(spec());
+        await driver.revoke(handle, 'inference');
+        const disconnects = calls.filter((c) => c[0] === 'network' && c[1] === 'disconnect');
+        assert.strictEqual(disconnects.length, 1);
+        assert.strictEqual(disconnects[0][3], 'agenthippo-litellm', 'the inference route, and only it');
+        assert.ok(!calls.some((c) => c[0] === 'rm'), 'revoking one route does not kill the sandbox');
+        // Revoking it twice is an error, not a silent success — the route is already gone.
+        await assert.rejects(driver.revoke(handle, 'inference'), types_1.RevocationUnsupportedError);
+    });
+    test("revoking a route the sandbox never had throws rather than reporting false success", async () => {
+        const { exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        const handle = await driver.create(spec({ routes: [{ kind: 'data', target: 'connector:9090' }] }));
+        await assert.rejects(driver.revoke(handle, 'egress'), types_1.RevocationUnsupportedError);
+    });
+    test("revoke 'all' and destroy both remove the container", async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        const h1 = await driver.create(spec());
+        await driver.revoke(h1, 'all');
+        const h2 = await driver.create(spec({ sessionKey: 'sess-2' }));
+        await driver.destroy(h2);
+        assert.strictEqual(calls.filter((c) => c[0] === 'rm').length, 2);
+    });
+    test('a mutable image tag is refused — signing and rollback would be unverifiable', async () => {
+        const { exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        for (const mutable of ['ghcr.io/agenthippoai/pack:latest', 'pack', 'pack:1.4.2']) {
+            await assert.rejects(driver.create(spec({ image: mutable })), /pinned by digest/, `must refuse ${mutable}`);
+        }
+    });
+    test('a bare image ID is accepted — locally built and air-gapped images are content-addressed too', async () => {
+        const { exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await assert.doesNotReject(driver.create(spec({ image: `sha256:${'a'.repeat(64)}` })));
+    });
+    test('fs entries support hostPath:sandboxPath mapping (a pack lives at an arbitrary host path)', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await driver.create(spec({ fs: { readonly: ['/host/packs/analyst:/app/pack'], writable: ['/host/state'] } }));
+        const line = calls.find((c) => c[0] === 'run').join(' ');
+        assert.ok(line.includes('--volume /host/packs/analyst:/app/pack:ro'), 'mapped read-only mount');
+        assert.ok(line.includes('--volume /host/state:/host/state'), 'plain path binds at the same path');
+    });
+    test('a stale socket left by a dead serve is never mistaken for a live sandbox', async () => {
+        // The live bug: serve restarts, its sandbox counter restarts at 1, and the per-sandbox socket
+        // directory of a PREVIOUS serve is adopted whole — including a `sandbox.sock` whose process
+        // is long gone. The waiter saw the file, returned instantly, and serve dialed a corpse:
+        // ECONNREFUSED reported as "sandbox channel closed", the retry landing on the next stale
+        // path, two containers per turn, every turn failing until serve was restarted again.
+        // A "container" that binds its socket, until `binds` is turned off.
+        let binds = true;
+        // A REAL unix socket, not an empty file: readiness is no longer "the path exists" — the
+        // driver lstats it and refuses anything that is not a socket it can vouch for, which is
+        // what stops another local account from planting one at the predictable path.
+        const bound = [];
+        const exec = async (args) => {
+            if (args[0] === 'run' && binds) {
+                const vol = args.find((a) => a.endsWith(':/run/sandbox'));
+                const sock = path.join(vol.slice(0, vol.lastIndexOf(':')), 'sandbox.sock');
+                const server = net.createServer();
+                await new Promise((resolve) => server.listen(sock, resolve));
+                bound.push(server);
+            }
+            if (args[0] === 'inspect') {
+                return { stdout: 'true', code: 0 };
+            }
+            if (args[0] === 'network' && args[1] === 'inspect') {
+                return { stdout: 'true\n', code: 0 };
+            }
+            return { stdout: args[0] === 'run' ? 'container-abc123' : '', code: 0 };
+        };
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 200 });
+        // Sandbox ids count up within a driver, so the NEXT sandbox's directory is predictable — plant
+        // the corpse there, exactly as a killed serve would have left it.
+        const first = await driver.create(spec());
+        binds = false;
+        const parts = path.basename(path.dirname(first.endpoint)).split('-');
+        parts[2] = String(Number(parts[2]) + 1);
+        const nextDir = path.join(TEST_SOCK_DIR, parts.join('-'));
+        fs.mkdirSync(nextDir, { recursive: true });
+        fs.writeFileSync(path.join(nextDir, 'sandbox.sock'), '');
+        // A driver that adopts the directory "succeeds" instantly and hands back a dead channel.
+        // One that purges waits for a socket this fake sandbox never binds, and says so.
+        await assert.rejects(driver.create(spec()), /did not bind/, "the socket must be THIS sandbox's, never a leftover file");
+        fs.rmSync(nextDir, { recursive: true, force: true });
+        for (const server of bound) {
+            server.close();
+        }
+    });
+    test('sandbox ids are unique per serve process — a restart cannot collide with orphaned sandboxes', async () => {
+        const { exec } = fakeExec();
+        const a = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        const b = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        const first = await a.create(spec());
+        const second = await b.create(spec());
+        // Same session, same counter position, different serve: `docker run --name` would fail
+        // outright against a leaked container, and the socket path would be shared.
+        assert.notStrictEqual(first.id, second.id);
+        assert.notStrictEqual(first.endpoint, second.endpoint);
+    });
+    test("a session's state dir outlives its sandbox — the resume gate (§8.4)", async () => {
+        // Everything resume needs (provider-sessions/, CODEX_HOME rollouts, CLAUDE_CONFIG_DIR,
+        // HOME) resolves under the sandbox's state root. A tmpfs there means every rehydrated sandbox
+        // starts a brand-new engine thread and the conversation silently restarts.
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await driver.create(spec({ stateDir: '/var/lib/agenthippo/sandbox-state/sess-1' }));
+        const line = calls.find((c) => c[0] === 'run').join(' ');
+        assert.ok(line.includes('--volume /var/lib/agenthippo/sandbox-state/sess-1:/state'), "the session's state dir is mounted at the sandbox state root");
+        assert.ok(!line.includes('--tmpfs /state'), 'and does NOT also get a tmpfs that would shadow it');
+    });
+    test('without a state dir the sandbox still boots — disposable state, no EROFS', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await driver.create(spec());
+        const line = calls.find((c) => c[0] === 'run').join(' ');
+        // A read-only rootfs without this dies at boot with EROFS: mkdir '/state/home'.
+        assert.ok(line.includes('--tmpfs /state:rw,exec,nosuid,size=512m,mode=1777'));
+    });
+    test('no secret reaches the sandbox environment (invariant 1)', async () => {
+        const { calls, exec } = fakeExec();
+        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
+        await driver.create(spec({ env: { AGENTHIPPO_SANDBOX_ID: 'sandbox-1', AGENTHIPPO_DATA_MCP_URL: 'http://connector:9090/mcp' } }));
+        const line = calls.find((c) => c[0] === 'run').join(' ');
+        for (const forbidden of ['API_KEY', 'PGPASSWORD', 'DATA_PLANE_TOKEN', 'SECRET']) {
+            assert.ok(!line.includes(forbidden), `no ${forbidden} may appear in the sandbox's env`);
+        }
+    });
+});
+/**
+ * Residual P4: on a single-uid host, a concurrent tenant reads a turn's nonce from
+ * /proc/<pid>/environ (same-uid) or the claude CLI's argv from /proc/<pid>/cmdline
+ * (world-readable). The PID/user-namespace wrap makes a sibling's pids unnameable — the only
+ * boundary that covers BOTH reads. What these tests pin is the decision logic around it: wrap
+ * exactly when asked-and-able, probe once not per sandbox, and 'require' failing closed.
+ */
+suite('process driver — namespace isolation (residual P4)', () => {
+    test("default is 'off': embedders and existing spawns are byte-identical", async () => {
+        const spawned = fakeSpawn();
+        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', args: ['host.js'], spawnFn: spawned });
+        await driver.create(spec({ tier: 0 }));
+        assert.deepStrictEqual(spawned.cmds[0], { cmd: 'node', args: ['host.js'] });
+    });
+    test("'auto' + capable host wraps the spawn in unshare, command preserved after the flags", async () => {
+        const spawned = fakeSpawn();
+        const driver = new processDriver_1.ProcessSandboxDriver({
+            command: 'node', args: ['host.js', '--stdio'],
+            namespaceIsolation: 'auto', probeFn: async () => true,
+            spawnFn: spawned,
+        });
+        await driver.create(spec({ tier: 0 }));
+        assert.deepStrictEqual(spawned.cmds[0], {
+            cmd: 'unshare',
+            args: [...processDriver_1.UNSHARE_WRAP_ARGS, 'node', 'host.js', '--stdio'],
+        });
+    });
+    test("'auto' + incapable host falls back to a plain spawn and warns ONCE", async () => {
+        const spawned = fakeSpawn();
+        const warnings = [];
+        const driver = new processDriver_1.ProcessSandboxDriver({
+            command: 'node',
+            namespaceIsolation: 'auto', probeFn: async () => false,
+            logger: { info: () => { }, warn: (m) => warnings.push(m) },
+            spawnFn: spawned,
+        });
+        await driver.create(spec({ tier: 0 }));
+        await driver.create(spec({ tier: 0 }));
+        assert.strictEqual(spawned.cmds[0].cmd, 'node');
+        assert.strictEqual(warnings.length, 1, 'the disclosure is per driver, not per sandbox');
+    });
+    test('the probe runs once per driver, not once per sandbox', async () => {
+        let probes = 0;
+        const driver = new processDriver_1.ProcessSandboxDriver({
+            command: 'node',
+            namespaceIsolation: 'auto', probeFn: async () => { probes++; return true; },
+            spawnFn: fakeSpawn(),
+        });
+        await driver.create(spec({ tier: 0 }));
+        await driver.create(spec({ tier: 0 }));
+        assert.strictEqual(probes, 1);
+    });
+    test("'require' + incapable host refuses to create ANY sandbox — fail closed, every time", async () => {
+        const spawned = fakeSpawn();
+        const driver = new processDriver_1.ProcessSandboxDriver({
+            command: 'node',
+            namespaceIsolation: 'require', probeFn: async () => false,
+            spawnFn: spawned,
+        });
+        await assert.rejects(driver.create(spec({ tier: 0 })), /require/);
+        // The cached decision must keep refusing, not accidentally resolve to a plain spawn.
+        await assert.rejects(driver.create(spec({ tier: 0 })), /require/);
+        assert.strictEqual(spawned.cmds.length, 0, 'no unwrapped sandbox may leak out before the failure');
+    });
+    test('the default probe exercises a NESTED userns — the codex/bwrap prerequisite, not just ours', async () => {
+        // A host can allow one namespace level and refuse the second (Ubuntu's AppArmor userns
+        // gating). A single-level probe would wrap, and every self-sandboxing engine turn would
+        // then die at bwrap. The probe must fail on such a host so it falls back for ALL engines.
+        const seen = [];
+        const probeSpawn = (cmd, args) => {
+            seen.push({ cmd, args });
+            const child = new node_events_1.EventEmitter();
+            child.kill = () => { };
+            queueMicrotask(() => child.emit('exit', 0));
+            return child;
+        };
+        const ok = await (0, processDriver_1.probeNamespaceIsolation)(probeSpawn);
+        assert.strictEqual(ok, true);
+        assert.strictEqual(seen[0].cmd, 'unshare');
+        assert.deepStrictEqual(seen[0].args, [...processDriver_1.NS_PROBE_ARGS]);
+        const inner = seen[0].args.slice(processDriver_1.UNSHARE_WRAP_ARGS.length);
+        assert.deepStrictEqual(inner, ['unshare', '--user', 'true'], 'the probed command must itself create a nested user namespace');
+    });
+    test('namespaceIsolationFromEnv: deployments default to auto; off and require are explicit', () => {
+        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({}), 'auto');
+        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({ AGENTHIPPO_SANDBOX_NS_ISOLATION: 'off' }), 'off');
+        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({ AGENTHIPPO_SANDBOX_NS_ISOLATION: '0' }), 'off');
+        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({ AGENTHIPPO_SANDBOX_NS_ISOLATION: 'require' }), 'require');
+        // An unrecognized value falls back to auto rather than silently disabling the hardening.
+        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({ AGENTHIPPO_SANDBOX_NS_ISOLATION: 'banana' }), 'auto');
+    });
+});
+suite('process driver — honest about having no boundary', () => {
+    test('per-route revoke throws instead of silently doing nothing', async () => {
+        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', spawnFn: fakeSpawn() });
+        const handle = await driver.create(spec({ tier: 0 }));
+        await assert.rejects(driver.revoke(handle, 'inference'), types_1.RevocationUnsupportedError);
+        await assert.rejects(driver.revoke(handle, 'data'), types_1.RevocationUnsupportedError);
+        assert.strictEqual(driver.tier, 0, 'declares tier 0 — no isolation boundary');
+    });
+    test("revoke 'all' kills the sandbox, which does remove every route", async () => {
+        const spawned = fakeSpawn();
+        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', spawnFn: spawned });
+        const handle = await driver.create(spec({ tier: 0 }));
+        await driver.revoke(handle, 'all');
+        assert.strictEqual(spawned.children[0].killed, true);
+    });
+    /**
+     * The regression: engines that sandbox THEMSELVES (codex via bubblewrap) stand their boundary
+     * down when something stronger surrounds them. A tier-0 sandbox is not stronger — it is the
+     * same uid and filesystem as serve — so `--sandbox process` used to be strictly WEAKER than no
+     * sandbox at all: codex's own confinement off, nothing underneath.
+     */
+    test('declares tier 0 to its child, so a self-sandboxing engine keeps its own boundary', async () => {
+        const spawned = fakeSpawn();
+        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', spawnFn: spawned });
+        await driver.create(spec({ tier: 0 }));
+        assert.strictEqual(spawned.envs[0][types_1.SANDBOX_TIER_ENV], '0');
+        assert.strictEqual((0, types_1.isContainerSandbox)(spawned.envs[0]), false);
+    });
+    test('a caller cannot overstate the boundary through spec.env', async () => {
+        const spawned = fakeSpawn();
+        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', spawnFn: spawned });
+        // A spec that claims tier 2 while running on the tier-0 driver must not reach the child
+        // saying so: the driver, not the caller, is what knows which boundary was really built.
+        await driver.create(spec({ tier: 2, env: { [types_1.SANDBOX_TIER_ENV]: '2' } }));
+        assert.strictEqual(spawned.envs[0][types_1.SANDBOX_TIER_ENV], '0');
+        assert.strictEqual((0, types_1.isContainerSandbox)(spawned.envs[0]), false);
+    });
+});
+suite('isContainerSandbox — fails safe', () => {
+    test('only tier 2 and above lets an engine drop its own confinement', () => {
+        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: '2' }), true);
+        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: '3' }), true);
+        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: '0' }), false);
+    });
+    test('absent, empty or unparseable means "assume no boundary"', () => {
+        assert.strictEqual((0, types_1.isContainerSandbox)({}), false);
+        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: '' }), false);
+        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: 'yes' }), false);
+        // The old flag is NOT a boundary claim — reading it as one is the bug this guards.
+        assert.strictEqual((0, types_1.isContainerSandbox)({ AGENTHIPPO_SANDBOX: '1' }), false);
+    });
+});
+suite('driver ⇄ runner integration (process driver, stdio transport)', () => {
+    test('a turn runs end to end through the driver-provided channel', async () => {
+        // Stand a real runner host on the "sandbox" side of the pipes the driver hands back.
+        const toRunner = new node_stream_1.PassThrough();
+        const toServe = new node_stream_1.PassThrough();
+        const engine = {
+            id: 'e', displayName: 'E',
+            async stream(_m, _o, emitter) { await emitter.text('from-sandbox'); },
+            onMaintenance() { }, dispose() { },
+        };
+        (0, host_1.startRunnerHost)({
+            engine,
+            runtime: { logger: { info() { }, warn() { }, error() { }, debug() { } } },
+            input: toRunner,
+            output: { write: (c) => toServe.write(c) },
+            maintenanceIntervalMs: 60_000,
+        });
+        const driver = new processDriver_1.ProcessSandboxDriver({
+            command: 'node',
+            spawnFn: fakeSpawn({ stdin: toRunner, stdout: toServe }),
+        });
+        const handle = await driver.create(spec({ tier: 0 }));
+        const remote = new remoteEngine_1.RemoteEngine({ id: 'e', displayName: 'E', channel: handle.connect() });
+        const seen = [];
+        const emitter = {
+            async thinking() { }, async text(d) { seen.push(d); }, async toolStart() { },
+            async toolEnd() { }, async progress() { },
+            async question() { return { selected: [], freeText: null, declined: true }; },
+            async error() { }, async done() { },
+        };
+        await remote.stream('go', {}, emitter, { logger: { info() { }, warn() { }, error() { }, debug() { } } });
+        assert.deepStrictEqual(seen, ['from-sandbox'], 'events crossed the driver channel and the turn settled');
+    });
+});
+/** Minimal ChildProcess stand-in: real streams, observable kill, no actual process. */
+function fakeSpawn(streams) {
+    const children = [];
+    const envs = [];
+    const cmds = [];
+    const fn = (cmd, args, opts) => {
+        cmds.push({ cmd: String(cmd), args: args ?? [] });
+        envs.push(opts?.env ?? {});
+        const child = {
+            stdin: streams?.stdin ?? new node_stream_1.PassThrough(),
+            stdout: streams?.stdout ?? new node_stream_1.PassThrough(),
+            exitCode: null,
+            killed: false,
+            kill(_sig) { this.killed = true; },
+            once() { return this; },
+            on() { return this; },
+        };
+        children.push(child);
+        return child;
+    };
+    return Object.assign(fn, { children, envs, cmds });
+}
+function stubChannel() {
+    return { input: new node_stream_1.PassThrough(), output: { write: () => true } };
+}
+suite('sandboxScriptArg', () => {
+    test('forwards a real script path when started as `node <script>`', () => {
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/bin/node', '/app/out/cli/index.js'], '/usr/bin/node'), ['/app/out/cli/index.js']);
+    });
+    // The regression: a compiled binary reports a virtual script path that its own runtime
+    // MOUNTS, so an existsSync check passes and the path still cannot be executed. Passing it
+    // made the sandbox process parse it as the subcommand and exit before the channel opened.
+    test('drops the virtual script path of a single-file build', () => {
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo', '/$bunfs/root/index.js'], '/usr/local/bin/agenthippo'), []);
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo', '/snapshot/app/index.js'], '/usr/local/bin/agenthippo'), []);
+    });
+    test('drops argv[1] when it is just the binary again, or absent', () => {
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo', '/usr/local/bin/agenthippo'], '/usr/local/bin/agenthippo'), []);
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo'], '/usr/local/bin/agenthippo'), []);
+    });
+});