fix: enforce sandbox execution boundary

tests/test_transport.py

@@ -0,0 +1,135 @@
+import json
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from glas_harness.contract import SandboxHandle
+from glas_harness.transport import ExecutionTransport, TransportError, transport_from_sandbox
+
+
+def test_local_namespace_transport_requires_pid_and_workspace(tmp_path: Path) -> None:
+    sandbox = SandboxHandle(
+        sandbox_id="sbx",
+        host="localhost",
+        reachability={"pid": "4321", "workspace_dir": str(tmp_path)},
+    )
+    transport = transport_from_sandbox(sandbox)
+
+    assert transport.kind == "local_namespace"
+    assert transport.workspace == str(tmp_path)
+    assert transport.command(["git", "status"]) == [
+        "nsenter",
+        "--target",
+        "4321",
+        "--mount",
+        "--pid",
+        "--net",
+        "--uts",
+        "--ipc",
+        "--",
+        "sh",
+        "-c",
+        'cd "$1" && shift && exec "$@"',
+        "sh",
+        str(tmp_path),
+        "git",
+        "status",
+    ]
+
+
+def test_remote_transport_wraps_command_without_local_shell() -> None:
+    sandbox = SandboxHandle(
+        sandbox_id="sbx",
+        host="sandboxer01",
+        reachability={"ssh": "agent@sandboxer01", "remote_dir": "/tmp/sbx"},
+    )
+    transport = transport_from_sandbox(sandbox)
+
+    assert transport.kind == "ssh"
+    assert transport.command(["git", "-C", "/tmp/sbx", "status"]) == [
+        "ssh",
+        "agent@sandboxer01",
+        "sh -c 'cd \"$1\" && shift && exec \"$@\"' sh /tmp/sbx git -C /tmp/sbx status",
+    ]
+
+
+@pytest.mark.parametrize(
+    "reachability",
+    [
+        {},
+        {"workspace_dir": "/tmp/ws"},
+        {"pid": "12"},
+        {"ssh": "agent@host"},
+        {"remote_dir": "/tmp/ws"},
+        {
+            "pid": "12",
+            "workspace_dir": "/tmp/ws",
+            "ssh": "agent@host",
+            "remote_dir": "/tmp/ws",
+        },
+    ],
+)
+def test_incomplete_or_ambiguous_reachability_fails_closed(reachability) -> None:
+    with pytest.raises(TransportError):
+        transport_from_sandbox(
+            SandboxHandle(sandbox_id="sbx", host="localhost", reachability=reachability)
+        )
+
+
+def test_local_task_file_is_private_and_removable(tmp_path: Path) -> None:
+    (tmp_path / ".git").mkdir()
+    transport = ExecutionTransport(
+        kind="local_namespace", workspace=str(tmp_path), pid=123
+    )
+    task_path = transport.write_task_file({"title": "bounded", "description": "safe"})
+    path = Path(task_path)
+
+    assert path.parent == tmp_path / ".git"
+    assert path.stat().st_mode & 0o777 == 0o600
+    assert json.loads(path.read_text())["title"] == "bounded"
+
+    transport.remove_file(task_path)
+    assert not path.exists()
+
+
+def test_remote_task_file_uses_ssh_stdin_and_cleanup() -> None:
+    transport = ExecutionTransport(
+        kind="ssh", workspace="/tmp/sbx", ssh_target="agent@sandboxer01"
+    )
+    completed = MagicMock(returncode=0, stdout="", stderr="")
+    with patch("glas_harness.transport.subprocess.run", return_value=completed) as run:
+        task_path = transport.write_task_file({"title": "bounded"})
+        transport.remove_file(task_path)
+
+    create = run.call_args_list[0]
+    assert create.args[0][:2] == ["ssh", "agent@sandboxer01"]
+    assert create.kwargs["input"] == '{"title": "bounded"}'
+    assert "cat >" in create.args[0][2]
+    assert "rm -f" in run.call_args_list[1].args[0][2]
+
+
+def test_resolve_executable_fails_inside_transport() -> None:
+    transport = ExecutionTransport(
+        kind="ssh", workspace="/tmp/sbx", ssh_target="agent@sandboxer01"
+    )
+    with patch.object(
+        ExecutionTransport,
+        "run",
+        return_value=MagicMock(returncode=127, stdout="", stderr="not found"),
+    ):
+        with pytest.raises(TransportError, match="not installed inside"):
+            transport.resolve_executable("rein-aharness")
+
+
+def test_git_head_fails_closed_on_transport_error() -> None:
+    transport = ExecutionTransport(
+        kind="ssh", workspace="/tmp/sbx", ssh_target="agent@sandboxer01"
+    )
+    with patch.object(
+        ExecutionTransport,
+        "run",
+        return_value=MagicMock(returncode=1, stdout="", stderr="permission denied"),
+    ):
+        with pytest.raises(TransportError, match="inside the selected sandbox"):
+            transport.git_head()