mirror of
https://github.com/hanzoai/dev.git
synced 2026-10-25 03:32:32 +00:00
zeekay
d660fd31c7
After the bin rename (codex->dev) and the hanzo default provider, upstream tests broke:
- 29 cargo_bin("codex") -> cargo_bin("dev") (integration tests spawned a
non-existent `codex` binary).
- exec integration tests (28) reached the real api.hanzo.ai because the mock
harness only overrode openai_base_url while the default provider is hanzo.
Fix: ONE DRY helper mock_server_config_overrides() (sets openai_base_url AND
pins the openai provider), consumed by cmd_with_server AND the resume test
(which had duplicated the override inline — the actual cause of its failure).
- doctor insta snapshot prefix codex__ -> dev__ (snapshot name tracks the bin
crate name).
- core feedback_tags doctest: bind the example vars so it compiles.
- main.rs plugin-marketplace help assertions codex -> dev (bin_name is dev).
Full workspace: 4552 passed. The remaining agent-graph-store failures are sqlite
pool-acquire saturation under full-workspace parallelism (30s timeout exceeded
when 100+ test binaries hit /tmp sqlite at once); they pass in isolation. CI
bounds this with nextest.
71 lines
1.7 KiB
Rust
71 lines
1.7 KiB
Rust
#![cfg(target_os = "linux")]
|
|
|
|
use std::net::TcpListener;
|
|
|
|
use anyhow::Result;
|
|
use tempfile::TempDir;
|
|
|
|
const BWRAP_UNAVAILABLE_ERR: &str = "bubblewrap is unavailable";
|
|
|
|
#[test]
|
|
fn sandbox_with_network_proxy_blocks_direct_loopback_access() -> Result<()> {
|
|
let codex_home = TempDir::new()?;
|
|
let listener = TcpListener::bind("127.0.0.2:0")?;
|
|
let port = listener.local_addr()?.port();
|
|
std::fs::write(
|
|
codex_home.path().join("config.toml"),
|
|
r#"
|
|
default_permissions = "network-test"
|
|
|
|
[features]
|
|
network_proxy = true
|
|
use_legacy_landlock = true
|
|
|
|
[permissions.network-test]
|
|
extends = ":workspace"
|
|
|
|
[permissions.network-test.network]
|
|
enabled = true
|
|
mode = "full"
|
|
"#,
|
|
)?;
|
|
|
|
let url = format!("http://127.0.0.2:{port}/");
|
|
let output = std::process::Command::new(codex_utils_cargo_bin::cargo_bin("dev")?)
|
|
.env("CODEX_HOME", codex_home.path())
|
|
.args([
|
|
"sandbox",
|
|
"--permissions-profile",
|
|
"network-test",
|
|
"--",
|
|
"curl",
|
|
"--noproxy",
|
|
"*",
|
|
"--silent",
|
|
"--show-error",
|
|
"--connect-timeout",
|
|
"1",
|
|
"--max-time",
|
|
"2",
|
|
url.as_str(),
|
|
])
|
|
.output()?;
|
|
|
|
let stderr = String::from_utf8_lossy(&output.stderr);
|
|
if stderr.contains(BWRAP_UNAVAILABLE_ERR) {
|
|
eprintln!("skipping network proxy sandbox test: bubblewrap is unavailable");
|
|
return Ok(());
|
|
}
|
|
|
|
assert_eq!(
|
|
output.status.code(),
|
|
Some(7),
|
|
"expected direct loopback access to be blocked; status={:?}; stdout={}; stderr={}",
|
|
output.status.code(),
|
|
String::from_utf8_lossy(&output.stdout),
|
|
stderr,
|
|
);
|
|
|
|
Ok(())
|
|
}
|