weichenandCursor
b85a1e1ca3
Why: The sandbox hides the host home directory and has no network, so pip install --user cannot supply python-docx, and the service PATH resolved python3 to a linuxbrew path that does not exist inside the sandbox. Evidence: SELF go test of execenv, tools, store, app, server, runmgr, config, and cmd/agent-system on this worktree. CI has not run. Impact: Sessions inherit a read-only base layer. Extra packages are requested through python_env, auto-approved only from the allowlist, and mounted per conversation. Schema 35 adds the request and binding tables. Refs: .task/feature-layered-python-env.md Co-authored-by: Cursor <cursoragent@cursor.com>
45 lines
1.4 KiB
Go
45 lines
1.4 KiB
Go
package execenv
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestSandboxImportPipAndOffline(t *testing.T) {
|
|
if _, err := exec.LookPath("bwrap"); err != nil {
|
|
t.Skip("bwrap not available")
|
|
}
|
|
if _, err := exec.LookPath("python3"); err != nil {
|
|
t.Skip("python3 not available")
|
|
}
|
|
root, err := Open(t.TempDir())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
site := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(site, "hello.py"), []byte("value = 1\n"), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
|
|
defer cancel()
|
|
if err := Doctor(ctx, "/usr/bin/python3", []string{site}, []string{"hello"}, true, []string{site}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
shim := filepath.Join(root.BinDir(), "pip")
|
|
out, err := exec.Command("bwrap", "--unshare-all", "--die-with-parent", "--ro-bind", "/", "/",
|
|
"--tmpfs", "/tmp", "--ro-bind", root.BinDir(), root.BinDir(), "--", shim).CombinedOutput()
|
|
if err == nil || !strings.Contains(string(out), "python_env") {
|
|
t.Fatalf("pip shim err=%v out=%s", err, out)
|
|
}
|
|
netOut, err := exec.Command("bwrap", "--unshare-net", "--die-with-parent", "--ro-bind", "/", "/",
|
|
"--", "/usr/bin/python3", "-c", "import socket; socket.create_connection(('1.1.1.1', 443), 2)").CombinedOutput()
|
|
if err == nil {
|
|
t.Fatalf("sandbox network should be unreachable, out=%s", netOut)
|
|
}
|
|
}
|