a3s-sandbox 0.1.3

Cross-platform native command sandbox for A3S
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

//! Gate 7 release-checklist invariants that must stay true for every release.

use crate::policy::{BackendCapabilities, FeatureFlags, SandboxPolicy};
use crate::NativeSandbox;

#[test]
fn gate7_release_default_profile_keeps_mediation_off() {
    let policy = SandboxPolicy::a3s_bash_baseline();
    assert!(
        !policy.features.mediated_network && !policy.features.mediated_socks,
        "default A3S Bash profile must keep mediation flags off"
    );
    assert!(
        policy.network.allow.is_empty(),
        "default profile must not ship network allow rules"
    );
    // Explicit FeatureFlags defaults are false (#[derive(Default)]).
    let flags = FeatureFlags::default();
    assert!(!flags.mediated_network && !flags.mediated_socks);
}

#[test]
fn gate7_release_capability_probe_lists_unavailable_surfaces() {
    let workspace = tempfile::tempdir().unwrap();
    let sandbox = NativeSandbox::new(workspace.path()).unwrap();
    let report = sandbox.capability_report();
    let caps = BackendCapabilities::native_gate2();
    if !caps.mediated_http {
        assert!(
            report.unavailable.contains(&"mediated_http"),
            "unavailable must list mediated_http when unclaimed: {:?}",
            report.unavailable
        );
    }
    if !caps.mediated_socks {
        assert!(report.unavailable.contains(&"mediated_socks"));
    }
    if !caps.unix_socket_allowlist {
        assert!(report.unavailable.contains(&"unix_socket_allowlist"));
    }
    assert_eq!(report.backend, crate::NATIVE_SANDBOX_BACKEND);
}

#[test]
fn gate7_release_claims_match_capability_matrix() {
    let caps = BackendCapabilities::native_gate2();
    #[cfg(target_os = "macos")]
    {
        assert!(caps.mediated_http);
        assert!(caps.mediated_socks);
        assert!(caps.unix_socket_allowlist);
    }
    #[cfg(target_os = "linux")]
    {
        assert!(caps.mediated_http);
        assert!(!caps.mediated_socks);
        assert!(!caps.unix_socket_allowlist);
    }
    #[cfg(windows)]
    {
        assert!(caps.mediated_http);
        assert!(!caps.mediated_socks);
        assert!(!caps.unix_socket_allowlist);
    }
}