ed/manual_slop
Private
Public Access
0
0
Fork 0
Code Activity

fix(sandbox): audit --tests-dir bypass EXCLUDE_DIRS; probe path in regression test

Browse Source
This commit is contained in:
ed
2026-06-19 08:14:34 -04:00
parent 8dddf5676a
commit 1f7e81ac55
2 changed files with 14 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/audit_test_sandbox_violations.py
+4 -3
View File
@@ -48,10 +48,10 @@ PATTERNS = [
EXCLUDE_DIRS = {"artifacts", "logs", "__pycache__", "snapshots"} EXCLUDE_DIRS = {"artifacts", "logs", "__pycache__", "snapshots"}
def find_violations(tests_dir: Path) -> list[tuple[Path, int, str]]: def find_violations(tests_dir: Path, apply_excludes: bool = True) -> list[tuple[Path, int, str]]:
violations: list[tuple[Path, int, str]] = [] violations: list[tuple[Path, int, str]] = []
for test_file in tests_dir.rglob("test_*.py"): for test_file in tests_dir.rglob("test_*.py"):
if any(excluded in test_file.parts for excluded in EXCLUDE_DIRS): if apply_excludes and any(excluded in test_file.parts for excluded in EXCLUDE_DIRS):
continue continue
try: try:
content = test_file.read_text(encoding="utf-8") content = test_file.read_text(encoding="utf-8")
@@ -80,7 +80,8 @@ def main() -> int:
if not tests_dir.exists(): if not tests_dir.exists():
print(f"Tests dir not found: {tests_dir}", file=sys.stderr) print(f"Tests dir not found: {tests_dir}", file=sys.stderr)
return 1 return 1
violations = find_violations(tests_dir) apply_excludes = (Path(args.tests_dir).resolve() == repo_root / "tests")
violations = find_violations(tests_dir, apply_excludes=apply_excludes)
if args.json: if args.json:
payload = { payload = {
tests/test_test_sandbox.py
+10 -12
View File
@@ -93,21 +93,19 @@ def test_audit_subprocess_bad_dir_exits_one() -> None:
def test_sandbox_blocks_writes_outside_tests_dir() -> None: def test_sandbox_blocks_writes_outside_tests_dir() -> None:
"""A write to <project_root>/manual_slop.toml raises TEST_SANDBOX_VIOLATION.""" """A write to <project_root>/manual_slop.toml raises TEST_SANDBOX_VIOLATION.
bad_path = Path(__file__).resolve().parent.parent / "manual_slop.toml" Per Python's sys.addaudithook contract, raising RuntimeError in the hook
if bad_path.exists(): aborts the open() call (the file is NOT created/truncated).
original = bad_path.read_bytes() [C: tests/conftest.py:_sandbox_audit_hook]"""
existed = True bad_path = Path(__file__).resolve().parent.parent / "_test_sandbox_probe.txt"
else:
existed = False
original = b""
try: try:
with pytest.raises(RuntimeError, match="TEST_SANDBOX_VIOLATION"): with pytest.raises(RuntimeError, match="TEST_SANDBOX"):
bad_path.write_text("corrupt", encoding="utf-8") bad_path.write_text("corrupt", encoding="utf-8")
assert not bad_path.exists(), (
f"TEST_SANDBOX_VIOLATION: file {bad_path} should NOT have been created"
)
finally: finally:
if existed: if bad_path.exists():
bad_path.write_bytes(original)
elif bad_path.exists():
bad_path.unlink() bad_path.unlink()