coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden SSH and profile resolution boundaries
Some checks failed
ci / validate (push) Has been cancelled
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b
This commit is contained in:
tegwick 2026-08-23 12:53:05 +02:00
parent 60564fda68
commit 695438019c
8 changed files with 176 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

29
tests/test_transport.py
View file

@ -49,11 +49,34 @@ def test_remote_transport_wraps_command_without_local_shell() -> None:
assert transport.kind == "ssh"
assert transport.command(["git", "-C", "/tmp/sbx", "status"]) == [
"ssh",
"--",
"agent@sandboxer01",
"sh -c 'cd \"$1\" && shift && exec \"$@\"' sh /tmp/sbx git -C /tmp/sbx status",
]
@pytest.mark.parametrize(
"ssh_target",
["-v", "-oProxyCommand", "agent@-host", "-agent@host", "agent@host extra"],
)
def test_remote_transport_rejects_ssh_option_and_invalid_targets(ssh_target) -> None:
sandbox = SandboxHandle(
sandbox_id="sbx",
host="sandboxer01",
reachability={"ssh": ssh_target, "remote_dir": "/tmp/sbx"},
)
with pytest.raises(TransportError, match="single non-option host"):
transport_from_sandbox(sandbox)
def test_direct_remote_transport_cannot_bypass_ssh_target_validation() -> None:
transport = ExecutionTransport(kind="ssh", workspace="/tmp/sbx", ssh_target="-v")
with pytest.raises(TransportError, match="single non-option host"):
transport.command(["true"])
@pytest.mark.parametrize(
"reachability",
[
@ -103,10 +126,10 @@ def test_remote_task_file_uses_ssh_stdin_and_cleanup() -> None:
transport.remove_file(task_path)
create = run.call_args_list[0]
assert create.args[0][:2] == ["ssh", "agent@sandboxer01"]
assert create.args[0][:3] == ["ssh", "--", "agent@sandboxer01"]
assert create.kwargs["input"] == '{"title": "bounded"}'
assert "cat >" in create.args[0][2]
assert "rm -f" in run.call_args_list[1].args[0][2]
assert "cat >" in create.args[0][3]
assert "rm -f" in run.call_args_list[1].args[0][3]
def test_resolve_executable_fails_inside_transport() -> None: