@celilo/cli 1.14.0 → 2.1.0

package/src/hooks/jail.ts

@@ -21,25 +21,82 @@
  *     reads.
  */
 
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import type { Dirent } from 'node:fs';
 import {
   existsSync,
   mkdirSync,
+  mkdtempSync,
   readFileSync,
   readdirSync,
   realpathSync,
   renameSync,
+  rmSync,
   statSync,
   writeFileSync,
 } from 'node:fs';
-import { hostname } from 'node:os';
+import { hostname, tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { getDataDir } from '../config/paths';
-import { type MountSet, type MountSetRequest, toBwrapArgs } from './mount-set';
+import { HOOK_SOCKET_ENV } from './hook-protocol';
+import {
+  type MountSet,
+  type MountSetRequest,
+  deriveMountSet,
+  toBwrapArgs,
+  toSandboxProfile,
+} from './mount-set';
+import { JAIL_PROVIDED_PATHS } from './unjailed-lint';
 
-/** Which jail celilo can build here. `none` means the hook runs unjailed. */
-export type JailBackend = 'bubblewrap' | 'none';
+/**
+ * Which jail celilo can build here. `none` means the hook runs unjailed.
+ *
+ * `sandbox-exec` is in the union ahead of its backend (task 4.8) because the
+ * POLICY for it is decided and landed first (ce-29z): `auto` defers on it
+ * until D14's declared-path mounts exist, and the planner below enforces
+ * that whether or not a platform reports the backend yet.
+ */
+export type JailBackend = 'bubblewrap' | 'sandbox-exec' | 'none';
+
+/**
+ * Whether `auto` may jail through `sandbox-exec`.
+ *
+ * False on purpose, and the load-bearing fact of ce-29z. Measured there,
+ * same hardware, one variable (`CELILO_HOOK_JAIL=off` equals main's
+ * behaviour): under bubblewrap a fixture hook's write to an undeclared host
+ * path lands in the private tmpfs (D13b) and succeeds silently, while under
+ * `sandbox-exec` the same write is `EPERM` — the hook exits non-zero and the
+ * full `apps/celilo` suite goes red on macOS where it is green on Linux CI.
+ * Sandbox-exec DENIES rather than masks, so the macOS jail is stricter than
+ * the Linux one for exactly the paths nobody declared.
+ *
+ * The mechanism that declares them is D14 (`type: path` on a manifest
+ * variable), and D14 is not built speculatively — task 4.2a measured the
+ * population and found no consumer that survives D9b. So `auto` defers on
+ * this backend until that mechanism lands; flip this to `true` as part of
+ * that landing, never before. `CELILO_HOOK_JAIL=required` bypasses the
+ * deferral: it is the operator's explicit act (D8), and an operator who sets
+ * it on macOS has opted into the strictness.
+ */
+const SANDBOX_EXEC_AUTO_JAIL_ENABLED = false;
+
+/**
+ * Why an `auto` sandbox-exec spawn was deferred. Operator-facing: it names
+ * the decision and the one way past it. Exported because `system doctor`
+ * renders the same deferral from (policy, availability) alone, where no plan
+ * — and so no plan reason — exists yet.
+ */
+export const SANDBOX_EXEC_AUTO_DEFERRED_REASON =
+  'macOS hooks run unjailed: sandbox-exec denies (EPERM) a hook write to any host path the mount set does not declare, where bubblewrap masks it into its private tmpfs — undeclared config paths would break module hooks on this host. The declaration mechanism (D14, manifest `type: path`) is not built, so auto defers on this backend (ce-29z). Set CELILO_HOOK_JAIL=required to jail anyway.';
+
+/**
+ * Does `auto` defer on this backend? Shared by the planner and by
+ * `system doctor`, so the doctor cannot report a jail the executor will not
+ * build.
+ */
+export function autoJailDefers(availability: JailAvailability): boolean {
+  return availability.backend === 'sandbox-exec' && !SANDBOX_EXEC_AUTO_JAIL_ENABLED;
+}
 
 /**
  * What the operator asked for. `CELILO_HOOK_JAIL`, and the default is `auto`.
@@ -75,13 +132,25 @@ export interface JailPlan {
    *
    * bubblewrap fails the whole jail on a bind whose SOURCE is missing, and
    * several rows are legitimately absent: `/lib64` does not exist on arm64,
-   * `<module>/generated` only appears once celilo has generated something, and
-   * `~/.ssh` need not exist at all. Dropping them is the caller's job rather
+   * and `<module>/generated` only appears once celilo has generated
+   * something. Dropping them is the caller's job rather
    * than the derivation's, which is why they are reported rather than silently
    * filtered — a contract input landing here is a real defect and this is
    * where it becomes visible.
    */
   readonly skipped: readonly string[];
+  /**
+   * The directory to spawn the child in, when the backend cannot set it itself.
+   *
+   * bubblewrap takes `--chdir`, so its plans leave this absent and the child
+   * inherits celilo's cwd — which the jail has replaced anyway.
+   * `sandbox-exec` has no equivalent, so the child inherits the OPERATOR's cwd
+   * and the profile does not name it. Measured 2026-08-27: `bun` reads its
+   * working directory before running anything, so a cwd outside the profile
+   * kills it with `error: An unknown error occurred (Unexpected)` and no
+   * further diagnostic. Naming the mount set's `chdir` here is the fix.
+   */
+  readonly cwd?: string;
 }
 
 /**
@@ -104,7 +173,17 @@ export interface JailPlan {
  * `--new-session` is NOT here. It defends against TIOCSTI injection into a
  * controlling terminal, and the child is spawned with `stdout: 'pipe'` and no
  * tty, so there is nothing to inject into.
+ *
+ * The `--proc`/`--dev` pairs are BUILT from `JAIL_PROVIDED_PATHS`
+ * (unjailed-lint.ts), the same list the advisory lint reads, so the spawn and
+ * the lint cannot disagree about what the namespace itself provides. Adding a
+ * path to that constant without a flag here is a compile error.
  */
+const JAIL_PROVIDED_FLAGS: Record<(typeof JAIL_PROVIDED_PATHS)[number], string> = {
+  '/proc': '--proc',
+  '/dev': '--dev',
+};
+
 const JAIL_NAMESPACE_ARGS = [
   '--unshare-user',
   '--unshare-ipc',
@@ -113,10 +192,7 @@ const JAIL_NAMESPACE_ARGS = [
   // The one unshare that legitimately may be unavailable on an older kernel.
   '--unshare-cgroup-try',
   '--die-with-parent',
-  '--proc',
-  '/proc',
-  '--dev',
-  '/dev',
+  ...JAIL_PROVIDED_PATHS.flatMap((path) => [JAIL_PROVIDED_FLAGS[path], path]),
 ] as const;
 
 /**
@@ -131,6 +207,24 @@ const JAIL_NAMESPACE_ARGS = [
  */
 const BWRAP = 'bwrap';
 
+/**
+ * The macOS jail builder.
+ *
+ * Pinned absolute, unlike `BWRAP`. There is no AppArmor-style profile to miss
+ * here, so `PATH` buys nothing and costs the one thing that matters: a
+ * `sandbox-exec` earlier on `PATH` would be handed every hook's profile and
+ * could report a jail it never built. The probe below would catch that, and
+ * pinning means it never has to.
+ */
+const SANDBOX_EXEC = '/usr/bin/sandbox-exec';
+
+/**
+ * The runner shim, named here as well as in the executor because the probe has
+ * to spawn the REAL one. A probe that starts a smaller program answers a
+ * question about a smaller program.
+ */
+const HOOK_RUNNER_PATH = join(import.meta.dir, 'hook-runner.ts');
+
 /** How long to wait for the probe before calling the backend unavailable. */
 const PROBE_TIMEOUT_MS = 10_000;
 
@@ -158,17 +252,7 @@ export function detectJailBackend(): JailAvailability {
 }
 
 function probeJailBackend(): JailAvailability {
-  if (process.platform === 'darwin') {
-    // `sandbox-exec` is measured working (D8) but the backend that generates
-    // its profile is task 4.8 and is not built. Claiming macOS is jailed
-    // because the tool exists would be the fail-open jail D8 calls worse than
-    // no jail at all.
-    return {
-      backend: 'none',
-      reason:
-        'macOS has no hook jail yet: the sandbox-exec backend is designed but not built (hook-process-boundary task 4.8). Hooks run unjailed on this host.',
-    };
-  }
+  if (process.platform === 'darwin') return probeSandboxExec();
   if (process.platform !== 'linux') {
     return {
       backend: 'none',
@@ -188,6 +272,118 @@ function probeJailBackend(): JailAvailability {
   }
 }
 
+/**
+ * What the probe plants and then tries to read. Its ABSENCE from the output is
+ * the evidence, so it is a string nothing else would print.
+ */
+const SANDBOX_PROBE_MARKER = 'celilo-jail-probe-reached-the-planted-file';
+
+/**
+ * Can this Mac jail? Measured by proving a DENIAL, never by finding the binary.
+ *
+ * This probe is shaped differently from bubblewrap's and the difference is the
+ * point. bubblewrap FAILS when it cannot build a namespace, loudly, with one of
+ * four distinct denials — so running it at all is the measurement.
+ * `sandbox-exec` does not fail. A profile it cannot apply to a path is simply
+ * not applied: the access succeeds and nothing anywhere reports an error (D8,
+ * measured, and re-measured 2026-08-27 in both directions — a rule naming
+ * `/tmp/x` where the kernel sees `/private/tmp/x` neither denies nor grants).
+ *
+ * So "sandbox-exec exists" is not evidence of anything, and neither is "the
+ * profile parsed". The only honest question is whether a file this probe
+ * planted, outside the profile, is actually unreachable from inside it. That is
+ * CLAUDE.md's reach probe applied to the jail itself: plant a marker, run the
+ * REAL machinery, and read which markers fired.
+ *
+ * Three outcomes, and the middle one is the one worth having:
+ *
+ *   - the read was refused          → `sandbox-exec`, the jail is real
+ *   - the read SUCCEEDED            → `none`, and the reason says fail-open.
+ *     A jail that is believed and absent is worse than no jail (D8).
+ *   - `sandbox-exec` never ran      → `none`, with its own message
+ */
+function probeSandboxExec(): JailAvailability {
+  let scratch: string | undefined;
+  try {
+    scratch = mkdtempSync(join(realpathOrSelf(tmpdir()), 'celilo-jail-probe-'));
+    const allowed = join(scratch, 'allowed');
+    const planted = join(scratch, 'planted');
+    mkdirSync(join(allowed, 'state'), { recursive: true });
+    writeFileSync(planted, SANDBOX_PROBE_MARKER);
+
+    // The REAL derivation, the REAL renderer, and the REAL shim path, so this
+    // clears the same bar the spawn does. Every shortcut here has already been
+    // measured to matter: a mount set built around `bun -e` omits the shim's
+    // `node_modules` rows, and the runtime then starts under the probe's
+    // profile and dies under the executor's.
+    const profile = toSandboxProfile(
+      deriveMountSet({
+        modulePath: allowed,
+        stateDir: join(allowed, 'state'),
+        socketDir: allowed,
+        runtimePath: process.execPath,
+        runnerPath: HOOK_RUNNER_PATH,
+        runtimeModulePaths: runtimeModulePathsFor(HOOK_RUNNER_PATH),
+        pathInputs: [],
+      }),
+    );
+    const run = (cmd: readonly string[]) =>
+      spawnSync(SANDBOX_EXEC, ['-p', profile, '--', ...cmd], {
+        cwd: allowed,
+        encoding: 'utf-8',
+        timeout: PROBE_TIMEOUT_MS,
+      });
+
+    // 1. Can the RUNTIME start? Spawn the actual shim with no socket in its
+    //    environment: it refuses immediately with a known message, having
+    //    already loaded itself, `@celilo/capabilities` and Zod. That is the
+    //    whole of the startup path, and it is where a jail that denies the
+    //    runtime something it needs shows up.
+    const started = run([process.execPath, HOOK_RUNNER_PATH]);
+    if (started.error) throw started.error;
+    if (!started.stderr?.includes(HOOK_SOCKET_ENV)) {
+      return {
+        backend: 'none',
+        reason: `sandbox-exec built a jail the hook runner cannot start in, so hooks run unjailed rather than failing one at a time. The runner exited ${started.status} saying: ${(started.stderr || started.stdout || '').trim().split('\n')[0] || '(nothing)'}`,
+      };
+    }
+
+    // 2. Does a DENIAL actually apply? `sandbox-exec` never fails on a rule it
+    //    cannot match — the access simply succeeds and nothing reports an
+    //    error (D8, measured). So the profile is not evidence; a file this
+    //    probe planted outside the mount set, and could not read, is.
+    const denied = run([
+      process.execPath,
+      '-e',
+      `try{require('node:fs').readFileSync(${JSON.stringify(planted)});console.log('${SANDBOX_PROBE_MARKER}')}catch{console.log('refused')}`,
+    ]);
+    if (denied.error) throw denied.error;
+    if ((denied.stdout ?? '').includes(SANDBOX_PROBE_MARKER)) {
+      return {
+        backend: 'none',
+        reason:
+          'sandbox-exec ran but did not enforce the profile: a file outside the mount set was still readable. Hooks run unjailed rather than appearing jailed and not being, which is the one outcome worse than no jail. This is usually an unresolved path in a rule — every path must be realpath()d before it is written.',
+      };
+    }
+
+    return { backend: 'sandbox-exec' };
+  } catch (error) {
+    const spawnFailure = (error as { code?: string } | null)?.code;
+    if (spawnFailure === 'ENOENT') {
+      return {
+        backend: 'none',
+        reason: `${SANDBOX_EXEC} is not on this macOS, so hooks run unjailed. It has carried a deprecation notice since 10.8; if Apple has removed it, this host has no hook jail backend.`,
+      };
+    }
+    return {
+      backend: 'none',
+      reason: `sandbox-exec could not run the probe, so hooks run unjailed: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  } finally {
+    if (scratch) rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
 /**
  * Turn the probe's failure into something an operator can act on.
  *
@@ -258,7 +454,6 @@ export function realpathRequest(request: MountSetRequest): MountSetRequest {
       ...input,
       value: realpathOrSelf(input.value),
     })),
-    sshDir: request.sshDir ? realpathOrSelf(request.sshDir) : undefined,
   };
 }
 
@@ -362,6 +557,14 @@ function realpathOrSelf(path: string): string {
  * @param set - The derived mount set, or `undefined` when the caller has no
  *   module tree to jail (the executor's own fixtures, and the bus handler path).
  */
+/**
+ * Why an `off` policy runs unjailed, shared with `celilo system doctor` (task
+ * 4.6) so the sentence the operator reads there is the sentence the record
+ * carries.
+ */
+export const JAIL_OFF_REASON =
+  'CELILO_HOOK_JAIL=off: the operator switched the hook jail off on this host.';
+
 export function planJailedSpawn(
   cmd: readonly string[],
   set: MountSet | undefined,
@@ -374,7 +577,7 @@ export function planJailedSpawn(
       cmd,
       mode: 'unjailed',
       backend: availability.backend,
-      reason: 'CELILO_HOOK_JAIL=off: the operator switched the hook jail off on this host.',
+      reason: JAIL_OFF_REASON,
       skipped: [],
     };
   }
@@ -391,18 +594,49 @@ export function planJailedSpawn(
     return { cmd, mode: 'unjailed', backend: availability.backend, reason, skipped: [] };
   }
 
+  // ce-29z: auto defers on sandbox-exec until D14 exists. Not an availability
+  // question — the backend is there; it is a policy one, which is why this
+  // sits in the planner rather than the probe.
+  if (policy === 'auto' && autoJailDefers(availability)) {
+    return {
+      cmd,
+      mode: 'unjailed',
+      backend: availability.backend,
+      reason: SANDBOX_EXEC_AUTO_DEFERRED_REASON,
+      skipped: [],
+    };
+  }
+
   // A tmpfs needs no source — bubblewrap creates it — so it is never dropped.
+  // The note below (ce-29z, 2026-09) is why 'required' is the only policy that
+  // reaches the sandbox-exec arm while SANDBOX_EXEC_AUTO_JAIL_ENABLED is
+  // false: the flag flip is D14's landing, never 4.8's.
   const present = set.entries.filter((e) => e.mode === 'tmpfs' || exists(e.path));
   const skipped = set.entries.filter((e) => !present.includes(e)).map((e) => e.path);
+  const applied: MountSet = { ...set, entries: present };
+
+  // Dropping an absent path is a bubblewrap NEED — it fails the whole jail on a
+  // bind with no source — and is merely tidy for `sandbox-exec`, which happily
+  // names a path that is not there. Both backends drop the same rows anyway,
+  // because a mount set that means two things on two platforms is exactly the
+  // drift task 4.7 exists to prevent.
+  if (availability.backend === 'sandbox-exec') {
+    // `-p` rather than a profile FILE: nothing to create, nothing to clean
+    // up, and nothing whose own readability has to be reasoned about.
+    // `sandbox-exec` reads the profile before it applies the sandbox, so a
+    // file would not have needed to be in the mount set — but it would have
+    // needed a lifetime, and this has none.
+    return {
+      cmd: [SANDBOX_EXEC, '-p', toSandboxProfile(applied), '--', ...cmd],
+      mode: 'jailed',
+      backend: availability.backend,
+      skipped,
+      cwd: set.chdir,
+    };
+  }
 
   return {
-    cmd: [
-      BWRAP,
-      ...JAIL_NAMESPACE_ARGS,
-      ...toBwrapArgs({ ...set, entries: present }),
-      '--',
-      ...cmd,
-    ],
+    cmd: [BWRAP, ...JAIL_NAMESPACE_ARGS, ...toBwrapArgs(applied), '--', ...cmd],
     mode: 'jailed',
     backend: availability.backend,
     skipped,
@@ -423,6 +657,20 @@ export interface JailModeRecord {
    */
   readonly host: string;
   readonly recordedAt: string;
+  /**
+   * The jailed record this host most recently held, present only on an
+   * `unjailed` record that replaced one on the SAME host.
+   *
+   * This is what makes the jailed-to-unjailed transition durable. The write
+   * below overwrites the previous record, so without this field the file for
+   * a host that used to jail and has stopped reads identically to a Mac that
+   * never jailed — and the self-monitor (task 4.4) runs on a sweep, long
+   * after `recordJailMode`'s return value is gone.
+   */
+  readonly lastJailed?: {
+    readonly backend: JailBackend;
+    readonly recordedAt: string;
+  };
 }
 
 /**
@@ -457,12 +705,14 @@ export function readJailMode(): JailModeRecord | undefined {
  */
 export function recordJailMode(plan: JailPlan): { previous?: JailModeRecord } {
   const previous = readJailMode();
+  const host = hostname();
   const record: JailModeRecord = {
     mode: plan.mode,
     backend: plan.backend,
     ...(plan.reason ? { reason: plan.reason } : {}),
-    host: hostname(),
+    host,
     recordedAt: new Date().toISOString(),
+    ...(lastJailedFor(plan.mode, previous, host) ?? {}),
   };
 
   if (
@@ -489,3 +739,25 @@ export function recordJailMode(plan: JailPlan): { previous?: JailModeRecord } {
   }
   return { previous };
 }
+
+/**
+ * What an unjailed record remembers about the last time this host jailed.
+ *
+ * A record from a DIFFERENT host contributes nothing: that is the
+ * copied-between-boxes case the `host` field exists for, and reading it as a
+ * transition would alert on a move that regressed nothing. A jailed record
+ * remembers nothing either — re-jailing is the recovery, and a later
+ * regression should date from the NEW jailed record, not the first ever.
+ */
+function lastJailedFor(
+  mode: JailMode,
+  previous: JailModeRecord | undefined,
+  host: string,
+): Pick<JailModeRecord, 'lastJailed'> | undefined {
+  if (mode !== 'unjailed' || !previous || previous.host !== host) return undefined;
+  if (previous.mode === 'jailed') {
+    return { lastJailed: { backend: previous.backend, recordedAt: previous.recordedAt } };
+  }
+  // unjailed → unjailed (a backend or reason change): the memory rides along.
+  return previous.lastJailed ? { lastJailed: previous.lastJailed } : undefined;
+}

package/src/hooks/mount-set.test.ts

@@ -7,7 +7,14 @@
  */
 
 import { describe, expect, test } from 'bun:test';
-import { deriveMountSet, forbiddenPaths, isForbidden, toBwrapArgs } from './mount-set';
+import { BROWSER_ROOT } from '@celilo/capabilities';
+import {
+  deriveMountSet,
+  forbiddenPaths,
+  isForbidden,
+  toBwrapArgs,
+  toSandboxProfile,
+} from './mount-set';
 
 const BASE = {
   modulePath: '/var/celilo/modules/caddy',
@@ -136,13 +143,115 @@ describe('paths are identical inside and outside', () => {
   });
 });
 
-describe('~/.ssh is stage 2 only', () => {
-  test('bound read-only when supplied', () => {
-    const set = deriveMountSet({ ...BASE, sshDir: '/var/celilo/.ssh' });
-    expect(set.entries.find((e) => e.path === '/var/celilo/.ssh')?.mode).toBe('ro');
+describe('~/.ssh is never in the mount set (stage 3, D12)', () => {
+  test('no derivation produces an .ssh row', () => {
+    // Withholding the key is what turns the remote-ops broker's target check
+    // from a convention into a boundary: with no credential in the jail, a
+    // hand-built `ssh` cannot authenticate anywhere.
+    expect(pathsOf(BASE).some((p) => p.endsWith('/.ssh'))).toBe(false);
   });
+});
 
-  test('absent when not supplied, which is what stage 3 does', () => {
-    expect(pathsOf(BASE).some((p) => p.endsWith('/.ssh'))).toBe(false);
+describe('the fleet browser is reachable, and only read-only (task 4.10)', () => {
+  test('BROWSER_ROOT is bound', () => {
+    // Task 4.10 names `~/.cache/ms-playwright`. That path is stale:
+    // `managed-browser-runtime` moved the browser into a celilo-owned tree,
+    // and `resolveBrowser()` — the thing a hook actually asks — returns
+    // `BROWSER_EXECUTABLE_PATH` under this root. Asserted against the exported
+    // constant rather than a literal, so a future move cannot leave this test
+    // passing about a directory nothing launches from.
+    expect(pathsOf(BASE)).toContain(BROWSER_ROOT);
+  });
+
+  test('read-only, because a hook has no business writing the shared install', () => {
+    expect(deriveMountSet(BASE).entries.find((e) => e.path === BROWSER_ROOT)?.mode).toBe('ro');
+  });
+
+  test('the data directory beside it stays out', () => {
+    // The row is one named subdirectory, not `/var/lib/celilo`. Binding the
+    // parent would put `celilo.db` and `master.key` back inside the jail —
+    // the exact acceptance criterion D9 satisfies by absence.
+    expect(pathsOf(BASE)).not.toContain('/var/lib/celilo');
+  });
+});
+
+describe('the sandbox-exec profile renders the same set (task 4.8)', () => {
+  const profileOf = (r: Parameters<typeof deriveMountSet>[0] = BASE) =>
+    toSandboxProfile(deriveMountSet(r));
+
+  test('a read-only mount is denied write and allowed read, in that order', () => {
+    const lines = profileOf().split('\n');
+    const deny = lines.indexOf(`(deny file-write* (subpath "${BASE.modulePath}"))`);
+    const allow = lines.indexOf(`(allow file-read* (subpath "${BASE.modulePath}"))`);
+    expect(deny).toBeGreaterThan(-1);
+    // SBPL is last-match-wins, so the deny must come FIRST or it would revoke
+    // the read it is paired with.
+    expect(allow).toBeGreaterThan(deny);
+  });
+
+  test('a writable directory nested in the read-only tree comes after it', () => {
+    const lines = profileOf().split('\n');
+    expect(
+      lines.indexOf(`(allow file-read* file-write* (subpath "${BASE.stateDir}"))`),
+    ).toBeGreaterThan(lines.indexOf(`(allow file-read* (subpath "${BASE.modulePath}"))`));
+  });
+
+  test('the tmpfs row grants nothing: macOS has no tmpfs and deny-default covers it', () => {
+    // The row still appears, as a comment, so a reader of the profile can see
+    // that the derivation asked for something this backend cannot give.
+    const profile = profileOf();
+    expect(profile).toContain('; /tmp: no tmpfs backend');
+    expect(profile).not.toContain('(subpath "/tmp")');
+  });
+
+  test('every ancestor is a literal, never a subpath', () => {
+    // A `subpath` grant on an ancestor would expose everything beneath it —
+    // `/var/celilo` holds master.key. `literal` permits stat and readdir of the
+    // directory node alone. This is the difference between D9's acceptance
+    // criterion holding and not.
+    const profile = profileOf();
+    expect(profile).toContain('(allow file-read* (literal "/var/celilo"))');
+    expect(profile).not.toContain('(allow file-read* (subpath "/var/celilo"))');
+    expect(profile).not.toContain('(subpath "/"))');
+  });
+
+  test('a forbidden path never reaches the profile', () => {
+    const profile = profileOf({
+      ...BASE,
+      pathInputs: [{ name: 'evil', value: '/usr/bin/bwrap', access: 'write' as const }],
+    });
+    expect(profile).not.toContain('(subpath "/usr/bin/bwrap")');
+  });
+
+  test('a quote in a path cannot end the rule early', () => {
+    const profile = profileOf({ ...BASE, modulePath: '/var/celilo/modules/od"d' });
+    expect(profile).toContain('(subpath "/var/celilo/modules/od\\"d")');
+  });
+
+  test('the network is allowed, because D9 does not namespace it', () => {
+    expect(profileOf()).toContain('(allow network*)');
+  });
+});
+
+describe('name resolution inside the jail (celilo#1225)', () => {
+  test('the resolver config is bound read-only', () => {
+    // Without these a hook resolves no NAME. getaddrinfo finds no nameserver
+    // and the call dies as ETIMEOUT, which reads as the remote endpoint being
+    // down. Measured on namecheap's validate_config against an endpoint that
+    // was up.
+    const set = deriveMountSet(BASE);
+    for (const path of ['/etc/resolv.conf', '/etc/nsswitch.conf', '/etc/hosts']) {
+      const row = set.entries.find((e) => e.path === path);
+      expect(row).toBeDefined();
+      expect(row?.mode).toBe('ro');
+    }
+  });
+
+  test('binding the resolver does not bind the rest of /etc', () => {
+    // The acceptance criterion for this jail is absence. Naming three files
+    // must not become naming a directory.
+    const set = deriveMountSet(BASE);
+    expect(set.entries.some((e) => e.path === '/etc')).toBe(false);
+    expect(set.entries.some((e) => e.path === '/etc/shadow')).toBe(false);
   });
 });