tegwick
4cffd7ded2
Deny-by-default bwrap egress: api.anthropic.com plus the 17 hosts in freedom-intelligence/docs/sources-egress.yaml. Workspace mirror rw. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 358047@bnt-lap001 Assistant-Session: fad68125-297a-449d-bfa7-cf9cdd49ca1d
31 lines
1.1 KiB
Python
31 lines
1.1 KiB
Python
"""Consumer profile loader smoke tests."""
|
|
|
|
from sandboxer.profiles.loader import load_profile
|
|
|
|
|
|
def test_profile_agent_dev_loads() -> None:
|
|
profile = load_profile("profile.agent-dev")
|
|
assert profile.id == "profile.agent-dev"
|
|
assert profile.extension == "ext.compose-ssh"
|
|
assert profile.scope_default == "agent"
|
|
assert profile.route is not None
|
|
assert profile.ttl.default == "8h"
|
|
|
|
|
|
def test_profile_build_loads() -> None:
|
|
profile = load_profile("profile.build")
|
|
assert profile.id == "profile.build"
|
|
assert profile.extension == "ext.vm-packer"
|
|
assert "build-registry-token" in profile.setup.secret_refs
|
|
assert profile.reachability.tunnel == "ops-bridge"
|
|
|
|
def test_profile_bwrap_fi_research_egress() -> None:
|
|
from sandboxer.extensions.egress import destinations
|
|
|
|
profile = load_profile("profile.bwrap-fi-research")
|
|
assert profile.extension == "ext.bwrap"
|
|
assert profile.network.default == "deny"
|
|
egress = profile.network.egress
|
|
assert len(egress) == len(destinations(egress)) == 18
|
|
assert "api.anthropic.com:443" in egress
|
|
assert profile.workspace.access == "rw"
|