coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Constrain controlled CLI sessions and prove native budget overshoot
Some checks failed
Governed runtime contract / contract (push) Failing after 27s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 20:53:25 +02:00
parent e0b3ff99a2
commit 4ae245a88f
14 changed files with 752 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

27
tests/test_native_limits.py
View file

@ -42,7 +42,7 @@ def test_native_controls_reach_cli_and_account_usage(tmp_path, stream):
patch(
"rein_aharness.adapter.subprocess.run",
return_value=subprocess.CompletedProcess(
[], 0, "2.1.263 (Claude Code)\n", ""
[], 0, "2.1.266 (Claude Code)\n", ""
),
),
patch("rein_aharness.adapter.subprocess.Popen", return_value=proc) as invoke,
@ -83,7 +83,7 @@ def test_error_preserves_only_bounded_cost():
assert caught.value.cost_usd == 0.1 and "secret" not in str(caught.value)
@pytest.mark.parametrize("version", ["2.1.216 (Claude Code)", "unrecognized"])
@pytest.mark.parametrize("version", ["2.1.216 (Claude Code)", "2.1.265 (Claude Code)", "unrecognized"])
def test_old_cli_refuses_before_prompt(tmp_path, version):
adapter = AgenticClaudeCodeAdapter(workdir=tmp_path)
with (
@ -93,7 +93,7 @@ def test_old_cli_refuses_before_prompt(tmp_path, version):
),
patch("rein_aharness.adapter.subprocess.Popen") as invoke,
):
with pytest.raises(NativeLimitError, match="2.1.217"):
with pytest.raises(NativeLimitError, match="2.1.266"):
adapter.execute_prompt(
"task", RunConfig(model_params={"max_budget_usd": 0.25})
)
@ -135,3 +135,24 @@ def test_runner_forwards_task_limits(tmp_path):
)
assert result.ok
assert adapter.configs[0].model_params == {"max_budget_usd": 0.25, "max_turns": 3}
@pytest.mark.parametrize("stream", [False, True])
def test_controlled_session_uses_closed_tools_and_skips_ambient_config(tmp_path, stream):
adapter = AgenticClaudeCodeAdapter(workdir=tmp_path, on_tool_event=(lambda e: None) if stream else None)
cmd = adapter._build_command(RunConfig(model_params={"max_budget_usd": 1, "max_turns": 4}))
assert cmd[cmd.index("--permission-mode")+1] == "dontAsk"
assert cmd[cmd.index("--tools")+1] == "Read,Write,Edit,Glob,Grep,Bash"
assert cmd[cmd.index("--setting-sources")+1] == ""
assert json.loads(cmd[cmd.index("--mcp-config")+1]) == {"mcpServers": {}}
assert "--bare" in cmd and "--strict-mcp-config" in cmd
assert cmd[cmd.index("--disallowedTools")+1] == "mcp__*"
def test_invalid_registered_tool_rule_refuses_before_prompt(tmp_path):
from rein_aharness.profiles import ToolProfile
adapter = AgenticClaudeCodeAdapter(workdir=tmp_path, tool_profile=ToolProfile("invalid", "test", "Read,*", "green"))
with patch("rein_aharness.adapter.subprocess.Popen") as invoke:
with pytest.raises(ValueError, match="builtin rule"):
adapter.execute_prompt("task", RunConfig(model_params={"max_turns": 1}))
invoke.assert_not_called()