@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/sandbox-driver.test.js

@@ -1,553 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  SandboxDriver (PLAN/serve-v4-clean.md §5).
- *
- *  The assertions here are the invariants, not the implementation details:
- *   - routes are STATIC at create; runtime change is revocation only;
- *   - a driver never pretends to enforce something it cannot (tier 0 per-route revoke throws);
- *   - the sandbox holds no secret in its environment;
- *   - the image is pinned by digest;
- *   - a half-wired sandbox is torn down rather than run.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("node:fs"));
-const net = __importStar(require("node:net"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
-const node_events_1 = require("node:events");
-const node_stream_1 = require("node:stream");
-const support_1 = require("../sandbox/support");
-const containerDriver_1 = require("../sandbox/containerDriver");
-const processDriver_1 = require("../sandbox/processDriver");
-const types_1 = require("../sandbox/types");
-const host_1 = require("../runner/host");
-const remoteEngine_1 = require("../runner/remoteEngine");
-const IMAGE = 'ghcr.io/agenthippoai/pack@sha256:' + 'a'.repeat(64);
-/** Unit tests must never create directories under the real /run/agenthippo/sandboxes. */
-const TEST_SOCK_DIR = path.join(os.tmpdir(), 'ah-sandbox-tests');
-function spec(over = {}) {
-    return {
-        sessionKey: 'sess-1',
-        image: IMAGE,
-        tier: 2,
-        routes: [
-            { kind: 'data', target: 'connector:9090' },
-            { kind: 'inference', target: 'litellm:4000' },
-        ],
-        fs: { readonly: [], writable: [] },
-        limits: { ttlSeconds: 0 },
-        ...over,
-    };
-}
-/** Records every runtime invocation so tests assert on the actual command line. */
-function fakeExec(overrides = {}) {
-    const calls = [];
-    const exec = async (args) => {
-        calls.push(args);
-        const key = args.slice(0, 2).join(' ');
-        const o = overrides[key];
-        if (o) {
-            return { stdout: o.stdout ?? '', code: o.code ?? 0 };
-        }
-        // `network inspect --format {{.Internal}}` must answer `true` here: these tests assert the
-        // tier-2 claim, and the driver now DOWNGRADES the reported tier when a route network is
-        // NAT'd (see sandbox-hardening.test.ts for that path). A blank answer used to mean
-        // "not internal" and silently made every one of these a tier-1 sandbox.
-        if (args[0] === 'network' && args[1] === 'inspect') {
-            return { stdout: 'true\n', code: 0 };
-        }
-        return { stdout: args[0] === 'run' ? 'container-abc123' : '', code: 0 };
-    };
-    return { calls, exec };
-}
-suite('container driver — the boundary it actually delivers', () => {
-    /**
-     * The in-process data plane and a local LiteLLM are BOTH loopback by default, so this was the
-     * default tier-2 configuration failing at `docker run` with "network agenthippo-127.0.0.1 not
-     * found" — a message about a symptom two layers from the cause.
-     */
-    test('a loopback route is refused with the reason, not a missing-network error', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await assert.rejects(driver.create(spec({ routes: [{ kind: 'inference', target: 'http://127.0.0.1:4000' }] })), /loopback/);
-        await assert.rejects(driver.create(spec({ routes: [{ kind: 'data', target: 'http://localhost:41234/mcp' }] })), /loopback/);
-        assert.ok(!calls.some((c) => c[0] === 'run'), 'refused before any container was created');
-    });
-    test('a route network that does not exist names itself, and no container is created', async () => {
-        const { calls, exec } = fakeExec({ 'network inspect': { code: 1, stdout: '' } });
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await assert.rejects(driver.create(spec()), /route network "agenthippo-connector" .* does not exist/);
-        assert.ok(!calls.some((c) => c[0] === 'run'), 'checked before `docker run`, not after it fails');
-    });
-    test('a route network that is not --internal is disclosed, not silently accepted', async () => {
-        const warnings = [];
-        // An inference route to an external proxy legitimately cannot be internal, so this must
-        // remain a warning: refusing here would forbid the normal deployment shape.
-        const { exec } = fakeExec({ 'network inspect': { code: 0, stdout: 'false' } });
-        const driver = new containerDriver_1.ContainerSandboxDriver({
-            exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0,
-            logger: { info() { }, warn: (m) => warnings.push(m) },
-        });
-        await driver.create(spec());
-        assert.ok(warnings.some((w) => w.includes('is not --internal')), 'operator is told the boundary is topology-dependent');
-    });
-    test('an --internal route network passes without noise', async () => {
-        const warnings = [];
-        const { exec } = fakeExec({ 'network inspect': { code: 0, stdout: 'true' } });
-        const driver = new containerDriver_1.ContainerSandboxDriver({
-            exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0,
-            logger: { info() { }, warn: (m) => warnings.push(m) },
-        });
-        await driver.create(spec());
-        assert.deepStrictEqual(warnings, []);
-    });
-    test('declares tier 2 to the sandbox, and spec.env cannot forge it', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await driver.create(spec({ env: { [types_1.SANDBOX_TIER_ENV]: '0' } }));
-        const run = calls.find((c) => c[0] === 'run');
-        // The driver's own tier is stamped after spec.env, so the LAST occurrence wins in docker
-        // and a caller cannot understate (or overstate) the boundary the container really provides.
-        const tierFlags = run.filter((_a, i) => run[i - 1] === '--env' && run[i].startsWith(`${types_1.SANDBOX_TIER_ENV}=`));
-        assert.strictEqual(tierFlags[tierFlags.length - 1], `${types_1.SANDBOX_TIER_ENV}=2`);
-    });
-    test('default-deny network, dropped caps, read-only fs, socket mount, digest-pinned image', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: '/tmp/sandboxes', connectFn: () => stubChannel(), socketWaitMs: 0 });
-        const handle = await driver.create(spec());
-        const run = calls.find((c) => c[0] === 'run');
-        const line = run.join(' ');
-        // Docker refuses `network connect` on a container created in `none` mode (verified live),
-        // so the first declared route is attached at create and the rest after. Either way the
-        // sandbox never joins the default bridge.
-        assert.ok(line.includes('--network agenthippo-connector'), 'sandbox is created directly on its first declared route network, never the default bridge');
-        assert.ok(line.includes('--cap-drop ALL'), 'capabilities dropped');
-        assert.ok(line.includes('--security-opt no-new-privileges'));
-        assert.ok(line.includes('--read-only'), 'root filesystem is read-only');
-        // A read-only root without a writable /tmp breaks tools that need scratch space —
-        // codex's bubblewrap sandbox panics outright.
-        assert.ok(line.includes('--tmpfs /tmp:rw,exec,nosuid,size=512m'), 'writable tmpfs at /tmp');
-        // One directory per sandbox, mounted at a fixed path inside: docker cannot bind-mount a
-        // socket file that does not exist yet (it would create a directory in its place).
-        assert.ok(line.includes(`--volume /tmp/sandboxes/${handle.id}:/run/sandbox`), 'exactly this sandbox\'s socket directory is mounted — reaching it IS the sandbox identity');
-        assert.strictEqual(handle.tier, 2);
-        assert.strictEqual(handle.endpoint, `/tmp/sandboxes/${handle.id}/sandbox.sock`);
-    });
-    test('attaches exactly the declared routes — one network per role, nothing else', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await driver.create(spec());
-        const runLine = calls.find((c) => c[0] === 'run').join(' ');
-        const connects = calls.filter((c) => c[0] === 'network' && c[1] === 'connect');
-        assert.ok(runLine.includes('--network agenthippo-connector'), 'first route attached at create');
-        assert.strictEqual(connects.length, 1, 'remaining routes attached after; no extras');
-        assert.strictEqual(connects[0][2], 'agenthippo-litellm');
-    });
-    test('a FAILED docker run leaves no container object behind', async () => {
-        const { calls, exec } = fakeExec({ 'run --detach': { code: 125, stdout: 'network not found' } });
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await assert.rejects(driver.create(spec()), /failed to create sandbox/);
-        assert.ok(calls.some((c) => c[0] === 'rm' && c.includes('--force')), 'the half-created container is swept, or its name stays taken and every retry fails');
-    });
-    test('a sandbox with no declared routes gets no network at all', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await driver.create(spec({ routes: [] }));
-        const line = calls.find((c) => c[0] === 'run').join(' ');
-        assert.ok(line.includes('--network none'), 'no routes ⇒ no network');
-        assert.ok(!calls.some((c) => c[0] === 'network' && c[1] === 'connect'));
-    });
-    test('a route that fails to attach tears the sandbox down — never run half-wired', async () => {
-        const { calls, exec } = fakeExec({ 'network connect': { code: 1, stdout: 'no such network' } });
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        // The first route rides `docker run`; this exercises a LATER route failing to attach.
-        await assert.rejects(driver.create(spec()), /failed to attach inference route/);
-        assert.ok(calls.some((c) => c[0] === 'rm' && c.includes('--force')), 'the partially-wired container is removed, not left running');
-    });
-    test('revoke detaches exactly one route and leaves the others intact (non-cooperative cap enforcement)', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        const handle = await driver.create(spec());
-        await driver.revoke(handle, 'inference');
-        const disconnects = calls.filter((c) => c[0] === 'network' && c[1] === 'disconnect');
-        assert.strictEqual(disconnects.length, 1);
-        assert.strictEqual(disconnects[0][3], 'agenthippo-litellm', 'the inference route, and only it');
-        assert.ok(!calls.some((c) => c[0] === 'rm'), 'revoking one route does not kill the sandbox');
-        // Revoking it twice is an error, not a silent success — the route is already gone.
-        await assert.rejects(driver.revoke(handle, 'inference'), types_1.RevocationUnsupportedError);
-    });
-    test("revoking a route the sandbox never had throws rather than reporting false success", async () => {
-        const { exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        const handle = await driver.create(spec({ routes: [{ kind: 'data', target: 'connector:9090' }] }));
-        await assert.rejects(driver.revoke(handle, 'egress'), types_1.RevocationUnsupportedError);
-    });
-    test("revoke 'all' and destroy both remove the container", async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        const h1 = await driver.create(spec());
-        await driver.revoke(h1, 'all');
-        const h2 = await driver.create(spec({ sessionKey: 'sess-2' }));
-        await driver.destroy(h2);
-        assert.strictEqual(calls.filter((c) => c[0] === 'rm').length, 2);
-    });
-    test('a mutable image tag is refused — signing and rollback would be unverifiable', async () => {
-        const { exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        for (const mutable of ['ghcr.io/agenthippoai/pack:latest', 'pack', 'pack:1.4.2']) {
-            await assert.rejects(driver.create(spec({ image: mutable })), /pinned by digest/, `must refuse ${mutable}`);
-        }
-    });
-    test('a bare image ID is accepted — locally built and air-gapped images are content-addressed too', async () => {
-        const { exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await assert.doesNotReject(driver.create(spec({ image: `sha256:${'a'.repeat(64)}` })));
-    });
-    test('fs entries support hostPath:sandboxPath mapping (a pack lives at an arbitrary host path)', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await driver.create(spec({ fs: { readonly: ['/host/packs/analyst:/app/pack'], writable: ['/host/state'] } }));
-        const line = calls.find((c) => c[0] === 'run').join(' ');
-        assert.ok(line.includes('--volume /host/packs/analyst:/app/pack:ro'), 'mapped read-only mount');
-        assert.ok(line.includes('--volume /host/state:/host/state'), 'plain path binds at the same path');
-    });
-    test('a stale socket left by a dead serve is never mistaken for a live sandbox', async () => {
-        // The live bug: serve restarts, its sandbox counter restarts at 1, and the per-sandbox socket
-        // directory of a PREVIOUS serve is adopted whole — including a `sandbox.sock` whose process
-        // is long gone. The waiter saw the file, returned instantly, and serve dialed a corpse:
-        // ECONNREFUSED reported as "sandbox channel closed", the retry landing on the next stale
-        // path, two containers per turn, every turn failing until serve was restarted again.
-        // A "container" that binds its socket, until `binds` is turned off.
-        let binds = true;
-        // A REAL unix socket, not an empty file: readiness is no longer "the path exists" — the
-        // driver lstats it and refuses anything that is not a socket it can vouch for, which is
-        // what stops another local account from planting one at the predictable path.
-        const bound = [];
-        const exec = async (args) => {
-            if (args[0] === 'run' && binds) {
-                const vol = args.find((a) => a.endsWith(':/run/sandbox'));
-                const sock = path.join(vol.slice(0, vol.lastIndexOf(':')), 'sandbox.sock');
-                const server = net.createServer();
-                await new Promise((resolve) => server.listen(sock, resolve));
-                bound.push(server);
-            }
-            if (args[0] === 'inspect') {
-                return { stdout: 'true', code: 0 };
-            }
-            if (args[0] === 'network' && args[1] === 'inspect') {
-                return { stdout: 'true\n', code: 0 };
-            }
-            return { stdout: args[0] === 'run' ? 'container-abc123' : '', code: 0 };
-        };
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 200 });
-        // Sandbox ids count up within a driver, so the NEXT sandbox's directory is predictable — plant
-        // the corpse there, exactly as a killed serve would have left it.
-        const first = await driver.create(spec());
-        binds = false;
-        const parts = path.basename(path.dirname(first.endpoint)).split('-');
-        parts[2] = String(Number(parts[2]) + 1);
-        const nextDir = path.join(TEST_SOCK_DIR, parts.join('-'));
-        fs.mkdirSync(nextDir, { recursive: true });
-        fs.writeFileSync(path.join(nextDir, 'sandbox.sock'), '');
-        // A driver that adopts the directory "succeeds" instantly and hands back a dead channel.
-        // One that purges waits for a socket this fake sandbox never binds, and says so.
-        await assert.rejects(driver.create(spec()), /did not bind/, "the socket must be THIS sandbox's, never a leftover file");
-        fs.rmSync(nextDir, { recursive: true, force: true });
-        for (const server of bound) {
-            server.close();
-        }
-    });
-    test('sandbox ids are unique per serve process — a restart cannot collide with orphaned sandboxes', async () => {
-        const { exec } = fakeExec();
-        const a = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        const b = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        const first = await a.create(spec());
-        const second = await b.create(spec());
-        // Same session, same counter position, different serve: `docker run --name` would fail
-        // outright against a leaked container, and the socket path would be shared.
-        assert.notStrictEqual(first.id, second.id);
-        assert.notStrictEqual(first.endpoint, second.endpoint);
-    });
-    test("a session's state dir outlives its sandbox — the resume gate (§8.4)", async () => {
-        // Everything resume needs (provider-sessions/, CODEX_HOME rollouts, CLAUDE_CONFIG_DIR,
-        // HOME) resolves under the sandbox's state root. A tmpfs there means every rehydrated sandbox
-        // starts a brand-new engine thread and the conversation silently restarts.
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await driver.create(spec({ stateDir: '/var/lib/agenthippo/sandbox-state/sess-1' }));
-        const line = calls.find((c) => c[0] === 'run').join(' ');
-        assert.ok(line.includes('--volume /var/lib/agenthippo/sandbox-state/sess-1:/state'), "the session's state dir is mounted at the sandbox state root");
-        assert.ok(!line.includes('--tmpfs /state'), 'and does NOT also get a tmpfs that would shadow it');
-    });
-    test('without a state dir the sandbox still boots — disposable state, no EROFS', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await driver.create(spec());
-        const line = calls.find((c) => c[0] === 'run').join(' ');
-        // A read-only rootfs without this dies at boot with EROFS: mkdir '/state/home'.
-        assert.ok(line.includes('--tmpfs /state:rw,exec,nosuid,size=512m,mode=1777'));
-    });
-    test('no secret reaches the sandbox environment (invariant 1)', async () => {
-        const { calls, exec } = fakeExec();
-        const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
-        await driver.create(spec({ env: { AGENTHIPPO_SANDBOX_ID: 'sandbox-1', AGENTHIPPO_DATA_MCP_URL: 'http://connector:9090/mcp' } }));
-        const line = calls.find((c) => c[0] === 'run').join(' ');
-        for (const forbidden of ['API_KEY', 'PGPASSWORD', 'DATA_PLANE_TOKEN', 'SECRET']) {
-            assert.ok(!line.includes(forbidden), `no ${forbidden} may appear in the sandbox's env`);
-        }
-    });
-});
-/**
- * Residual P4: on a single-uid host, a concurrent tenant reads a turn's nonce from
- * /proc/<pid>/environ (same-uid) or the claude CLI's argv from /proc/<pid>/cmdline
- * (world-readable). The PID/user-namespace wrap makes a sibling's pids unnameable — the only
- * boundary that covers BOTH reads. What these tests pin is the decision logic around it: wrap
- * exactly when asked-and-able, probe once not per sandbox, and 'require' failing closed.
- */
-suite('process driver — namespace isolation (residual P4)', () => {
-    test("default is 'off': embedders and existing spawns are byte-identical", async () => {
-        const spawned = fakeSpawn();
-        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', args: ['host.js'], spawnFn: spawned });
-        await driver.create(spec({ tier: 0 }));
-        assert.deepStrictEqual(spawned.cmds[0], { cmd: 'node', args: ['host.js'] });
-    });
-    test("'auto' + capable host wraps the spawn in unshare, command preserved after the flags", async () => {
-        const spawned = fakeSpawn();
-        const driver = new processDriver_1.ProcessSandboxDriver({
-            command: 'node', args: ['host.js', '--stdio'],
-            namespaceIsolation: 'auto', probeFn: async () => true,
-            spawnFn: spawned,
-        });
-        await driver.create(spec({ tier: 0 }));
-        assert.deepStrictEqual(spawned.cmds[0], {
-            cmd: 'unshare',
-            args: [...processDriver_1.UNSHARE_WRAP_ARGS, 'node', 'host.js', '--stdio'],
-        });
-    });
-    test("'auto' + incapable host falls back to a plain spawn and warns ONCE", async () => {
-        const spawned = fakeSpawn();
-        const warnings = [];
-        const driver = new processDriver_1.ProcessSandboxDriver({
-            command: 'node',
-            namespaceIsolation: 'auto', probeFn: async () => false,
-            logger: { info: () => { }, warn: (m) => warnings.push(m) },
-            spawnFn: spawned,
-        });
-        await driver.create(spec({ tier: 0 }));
-        await driver.create(spec({ tier: 0 }));
-        assert.strictEqual(spawned.cmds[0].cmd, 'node');
-        assert.strictEqual(warnings.length, 1, 'the disclosure is per driver, not per sandbox');
-    });
-    test('the probe runs once per driver, not once per sandbox', async () => {
-        let probes = 0;
-        const driver = new processDriver_1.ProcessSandboxDriver({
-            command: 'node',
-            namespaceIsolation: 'auto', probeFn: async () => { probes++; return true; },
-            spawnFn: fakeSpawn(),
-        });
-        await driver.create(spec({ tier: 0 }));
-        await driver.create(spec({ tier: 0 }));
-        assert.strictEqual(probes, 1);
-    });
-    test("'require' + incapable host refuses to create ANY sandbox — fail closed, every time", async () => {
-        const spawned = fakeSpawn();
-        const driver = new processDriver_1.ProcessSandboxDriver({
-            command: 'node',
-            namespaceIsolation: 'require', probeFn: async () => false,
-            spawnFn: spawned,
-        });
-        await assert.rejects(driver.create(spec({ tier: 0 })), /require/);
-        // The cached decision must keep refusing, not accidentally resolve to a plain spawn.
-        await assert.rejects(driver.create(spec({ tier: 0 })), /require/);
-        assert.strictEqual(spawned.cmds.length, 0, 'no unwrapped sandbox may leak out before the failure');
-    });
-    test('the default probe exercises a NESTED userns — the codex/bwrap prerequisite, not just ours', async () => {
-        // A host can allow one namespace level and refuse the second (Ubuntu's AppArmor userns
-        // gating). A single-level probe would wrap, and every self-sandboxing engine turn would
-        // then die at bwrap. The probe must fail on such a host so it falls back for ALL engines.
-        const seen = [];
-        const probeSpawn = (cmd, args) => {
-            seen.push({ cmd, args });
-            const child = new node_events_1.EventEmitter();
-            child.kill = () => { };
-            queueMicrotask(() => child.emit('exit', 0));
-            return child;
-        };
-        const ok = await (0, processDriver_1.probeNamespaceIsolation)(probeSpawn);
-        assert.strictEqual(ok, true);
-        assert.strictEqual(seen[0].cmd, 'unshare');
-        assert.deepStrictEqual(seen[0].args, [...processDriver_1.NS_PROBE_ARGS]);
-        const inner = seen[0].args.slice(processDriver_1.UNSHARE_WRAP_ARGS.length);
-        assert.deepStrictEqual(inner, ['unshare', '--user', 'true'], 'the probed command must itself create a nested user namespace');
-    });
-    test('namespaceIsolationFromEnv: deployments default to auto; off and require are explicit', () => {
-        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({}), 'auto');
-        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({ AGENTHIPPO_SANDBOX_NS_ISOLATION: 'off' }), 'off');
-        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({ AGENTHIPPO_SANDBOX_NS_ISOLATION: '0' }), 'off');
-        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({ AGENTHIPPO_SANDBOX_NS_ISOLATION: 'require' }), 'require');
-        // An unrecognized value falls back to auto rather than silently disabling the hardening.
-        assert.strictEqual((0, processDriver_1.namespaceIsolationFromEnv)({ AGENTHIPPO_SANDBOX_NS_ISOLATION: 'banana' }), 'auto');
-    });
-});
-suite('process driver — honest about having no boundary', () => {
-    test('per-route revoke throws instead of silently doing nothing', async () => {
-        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', spawnFn: fakeSpawn() });
-        const handle = await driver.create(spec({ tier: 0 }));
-        await assert.rejects(driver.revoke(handle, 'inference'), types_1.RevocationUnsupportedError);
-        await assert.rejects(driver.revoke(handle, 'data'), types_1.RevocationUnsupportedError);
-        assert.strictEqual(driver.tier, 0, 'declares tier 0 — no isolation boundary');
-    });
-    test("revoke 'all' kills the sandbox, which does remove every route", async () => {
-        const spawned = fakeSpawn();
-        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', spawnFn: spawned });
-        const handle = await driver.create(spec({ tier: 0 }));
-        await driver.revoke(handle, 'all');
-        assert.strictEqual(spawned.children[0].killed, true);
-    });
-    /**
-     * The regression: engines that sandbox THEMSELVES (codex via bubblewrap) stand their boundary
-     * down when something stronger surrounds them. A tier-0 sandbox is not stronger — it is the
-     * same uid and filesystem as serve — so `--sandbox process` used to be strictly WEAKER than no
-     * sandbox at all: codex's own confinement off, nothing underneath.
-     */
-    test('declares tier 0 to its child, so a self-sandboxing engine keeps its own boundary', async () => {
-        const spawned = fakeSpawn();
-        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', spawnFn: spawned });
-        await driver.create(spec({ tier: 0 }));
-        assert.strictEqual(spawned.envs[0][types_1.SANDBOX_TIER_ENV], '0');
-        assert.strictEqual((0, types_1.isContainerSandbox)(spawned.envs[0]), false);
-    });
-    test('a caller cannot overstate the boundary through spec.env', async () => {
-        const spawned = fakeSpawn();
-        const driver = new processDriver_1.ProcessSandboxDriver({ command: 'node', spawnFn: spawned });
-        // A spec that claims tier 2 while running on the tier-0 driver must not reach the child
-        // saying so: the driver, not the caller, is what knows which boundary was really built.
-        await driver.create(spec({ tier: 2, env: { [types_1.SANDBOX_TIER_ENV]: '2' } }));
-        assert.strictEqual(spawned.envs[0][types_1.SANDBOX_TIER_ENV], '0');
-        assert.strictEqual((0, types_1.isContainerSandbox)(spawned.envs[0]), false);
-    });
-});
-suite('isContainerSandbox — fails safe', () => {
-    test('only tier 2 and above lets an engine drop its own confinement', () => {
-        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: '2' }), true);
-        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: '3' }), true);
-        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: '0' }), false);
-    });
-    test('absent, empty or unparseable means "assume no boundary"', () => {
-        assert.strictEqual((0, types_1.isContainerSandbox)({}), false);
-        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: '' }), false);
-        assert.strictEqual((0, types_1.isContainerSandbox)({ [types_1.SANDBOX_TIER_ENV]: 'yes' }), false);
-        // The old flag is NOT a boundary claim — reading it as one is the bug this guards.
-        assert.strictEqual((0, types_1.isContainerSandbox)({ AGENTHIPPO_SANDBOX: '1' }), false);
-    });
-});
-suite('driver ⇄ runner integration (process driver, stdio transport)', () => {
-    test('a turn runs end to end through the driver-provided channel', async () => {
-        // Stand a real runner host on the "sandbox" side of the pipes the driver hands back.
-        const toRunner = new node_stream_1.PassThrough();
-        const toServe = new node_stream_1.PassThrough();
-        const engine = {
-            id: 'e', displayName: 'E',
-            async stream(_m, _o, emitter) { await emitter.text('from-sandbox'); },
-            onMaintenance() { }, dispose() { },
-        };
-        (0, host_1.startRunnerHost)({
-            engine,
-            runtime: { logger: { info() { }, warn() { }, error() { }, debug() { } } },
-            input: toRunner,
-            output: { write: (c) => toServe.write(c) },
-            maintenanceIntervalMs: 60_000,
-        });
-        const driver = new processDriver_1.ProcessSandboxDriver({
-            command: 'node',
-            spawnFn: fakeSpawn({ stdin: toRunner, stdout: toServe }),
-        });
-        const handle = await driver.create(spec({ tier: 0 }));
-        const remote = new remoteEngine_1.RemoteEngine({ id: 'e', displayName: 'E', channel: handle.connect() });
-        const seen = [];
-        const emitter = {
-            async thinking() { }, async text(d) { seen.push(d); }, async toolStart() { },
-            async toolEnd() { }, async progress() { },
-            async question() { return { selected: [], freeText: null, declined: true }; },
-            async error() { }, async done() { },
-        };
-        await remote.stream('go', {}, emitter, { logger: { info() { }, warn() { }, error() { }, debug() { } } });
-        assert.deepStrictEqual(seen, ['from-sandbox'], 'events crossed the driver channel and the turn settled');
-    });
-});
-/** Minimal ChildProcess stand-in: real streams, observable kill, no actual process. */
-function fakeSpawn(streams) {
-    const children = [];
-    const envs = [];
-    const cmds = [];
-    const fn = (cmd, args, opts) => {
-        cmds.push({ cmd: String(cmd), args: args ?? [] });
-        envs.push(opts?.env ?? {});
-        const child = {
-            stdin: streams?.stdin ?? new node_stream_1.PassThrough(),
-            stdout: streams?.stdout ?? new node_stream_1.PassThrough(),
-            exitCode: null,
-            killed: false,
-            kill(_sig) { this.killed = true; },
-            once() { return this; },
-            on() { return this; },
-        };
-        children.push(child);
-        return child;
-    };
-    return Object.assign(fn, { children, envs, cmds });
-}
-function stubChannel() {
-    return { input: new node_stream_1.PassThrough(), output: { write: () => true } };
-}
-suite('sandboxScriptArg', () => {
-    test('forwards a real script path when started as `node <script>`', () => {
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/bin/node', '/app/out/cli/index.js'], '/usr/bin/node'), ['/app/out/cli/index.js']);
-    });
-    // The regression: a compiled binary reports a virtual script path that its own runtime
-    // MOUNTS, so an existsSync check passes and the path still cannot be executed. Passing it
-    // made the sandbox process parse it as the subcommand and exit before the channel opened.
-    test('drops the virtual script path of a single-file build', () => {
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo', '/$bunfs/root/index.js'], '/usr/local/bin/agenthippo'), []);
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo', '/snapshot/app/index.js'], '/usr/local/bin/agenthippo'), []);
-    });
-    test('drops argv[1] when it is just the binary again, or absent', () => {
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo', '/usr/local/bin/agenthippo'], '/usr/local/bin/agenthippo'), []);
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo'], '/usr/local/bin/agenthippo'), []);
-    });
-});