fix: execute local reins through the sandbox owner

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

tests/test_transport.py

@@ -14,28 +14,18 @@ def test_local_namespace_transport_requires_pid_and_workspace(tmp_path: Path) ->
         host="localhost",
         reachability={"pid": "4321", "workspace_dir": str(tmp_path)},
     )
+    sandbox._owner_execute = MagicMock(return_value=MagicMock(
+        timed_out=False, output_truncated=False, exit_code=0, stdout="ok", stderr=""
+    ))
     transport = transport_from_sandbox(sandbox)
-
     assert transport.kind == "local_namespace"
     assert transport.workspace == str(tmp_path)
-    assert transport.command(["git", "status"]) == [
-        "nsenter",
-        "--target",
-        "4321",
-        "--mount",
-        "--pid",
-        "--net",
-        "--uts",
-        "--ipc",
-        "--",
-        "sh",
-        "-c",
-        'cd "$1" && shift && exec "$@"',
-        "sh",
-        str(tmp_path),
-        "git",
-        "status",
-    ]
+    with patch("glas_harness.transport.subprocess.run") as run:
+        assert transport.run(["git", "status"], timeout=30).stdout == "ok"
+    run.assert_not_called()
+    sandbox._owner_execute.assert_called_once_with(["git", "status"], None, 30)
+    with pytest.raises(TransportError, match="owner execution"):
+        transport.command(["git", "status"])
 
 
 def test_remote_transport_wraps_command_without_local_shell() -> None:
@@ -100,20 +90,47 @@ def test_incomplete_or_ambiguous_reachability_fails_closed(reachability) -> None
         )
 
 
-def test_local_task_file_is_private_and_removable(tmp_path: Path) -> None:
-    (tmp_path / ".git").mkdir()
+def test_local_task_file_uses_owner_stdin_and_cleanup(tmp_path: Path) -> None:
+    owner = MagicMock(return_value=MagicMock(
+        timed_out=False, output_truncated=False, exit_code=0, stdout="", stderr=""
+    ))
     transport = ExecutionTransport(
-        kind="local_namespace", workspace=str(tmp_path), pid=123
+        kind="local_namespace", workspace=str(tmp_path), pid=123, owner_execute=owner,
+        timeout_seconds=7,
     )
-    task_path = transport.write_task_file({"title": "bounded", "description": "safe"})
-    path = Path(task_path)
-
-    assert path.parent == tmp_path / ".git"
-    assert path.stat().st_mode & 0o777 == 0o600
-    assert json.loads(path.read_text())["title"] == "bounded"
-
+    task_path = transport.write_task_file({"title": "private prompt"})
+    command, stdin, timeout = owner.call_args.args
+    assert "umask 077; set -C; cat" in command[2]
+    assert "private prompt" not in str(command)
+    assert json.loads(stdin) == {"title": "private prompt"}
+    assert timeout == 7
+    assert Path(task_path).parent == tmp_path / ".git"
+    assert not Path(task_path).exists()  # No host write, even with a fake owner.
     transport.remove_file(task_path)
-    assert not path.exists()
+    owner.assert_called_with(["rm", "-f", "--", task_path], None, 7)
+
+
+def test_local_descriptor_without_owner_fails_closed():
+    with pytest.raises(TransportError, match="owner execution binding"):
+        transport_from_sandbox(SandboxHandle(
+            sandbox_id="sbx", host="localhost",
+            reachability={"pid": "123", "workspace_dir": "/tmp/ws"},
+        ))
+
+
+@pytest.mark.parametrize("timed_out,truncated", [(True, False), (False, True)])
+def test_owner_timeout_and_truncation_fail_closed(timed_out, truncated):
+    import subprocess
+    owner = MagicMock(return_value=MagicMock(
+        timed_out=timed_out, output_truncated=truncated
+    ))
+    transport = ExecutionTransport(
+        kind="local_namespace", workspace="/tmp/ws", owner_execute=owner,
+        timeout_seconds=3,
+    )
+    with pytest.raises(subprocess.TimeoutExpired if timed_out else TransportError):
+        transport.run(["true"], timeout=30)
+    owner.assert_called_once_with(["true"], None, 3)
 
 
 def test_remote_task_file_uses_ssh_stdin_and_cleanup() -> None: