tenant.openagents/omega

1#!/usr/bin/env pwsh
2# Provision the default WSL distro for the Windows sandbox behavior tests and
3# run them. The Windows analog of running `cargo xtask sandbox-tests` on Linux.
4#
5# What it does:
6#   1. Checks that WSL is installed.
7#   2. (Unless -NoProvision) installs `bubblewrap` into the default distro and
8#      enables unprivileged user namespaces, so the sandbox can actually be
9#      enforced. Without both, the helper can only SKIP the enforcement checks —
10#      it can't verify a sandbox that was never set up. On Ubuntu 24.04 (the
11#      current default WSL distro) user namespaces are restricted by AppArmor by
12#      default, which is exactly why this step is needed.
13#   3. Runs `cargo xtask wsl-sandbox-tests`, which builds and runs
14#      `wsl_sandbox_test_helper` against the real WSL/Bubblewrap sandbox.
15#
16# By default it requires the sandbox to actually be enforced (so a broken setup
17# fails loudly instead of silently skipping). Pass -AllowSkip to keep the
18# helper's default skip-when-unenforceable behavior.
19#
20# Notes:
21#   * Provisioning runs as root via `wsl -u root`, so it needs no sudo password.
22#   * Auto-provisioning only supports apt-based distros (Ubuntu/Debian). For
23#     others, install `bubblewrap` yourself and re-run with -NoProvision.
24#   * The user-namespace sysctl is set for the running WSL VM only; it resets
25#     after `wsl --shutdown`.
26#   * If the network checks are skipped, Windows Firewall may be blocking the
27#     test's local listener; that only affects the network assertions.
28#
29# Usage:
30#   ./script/test-wsl-sandbox.ps1
31#   ./script/test-wsl-sandbox.ps1 -NoProvision
32#   ./script/test-wsl-sandbox.ps1 -Release
33#   ./script/test-wsl-sandbox.ps1 -AllowSkip
34
35[CmdletBinding()]
36param(
37    [switch]$NoProvision,
38    [switch]$Release,
39    [switch]$AllowSkip
40)
41
42$ErrorActionPreference = "Stop"
43
44if (-not (Get-Command wsl.exe -ErrorAction SilentlyContinue)) {
45    Write-Error "wsl.exe was not found. Install WSL (https://learn.microsoft.com/windows/wsl/install) and try again."
46}
47
48# Run a command in the default WSL distro as root, throwing on failure.
49function Invoke-WslRoot {
50    param([Parameter(Mandatory = $true)][string]$Script)
51    & wsl.exe -u root -- sh -c $Script
52    if ($LASTEXITCODE -ne 0) {
53        throw "WSL command failed (exit $LASTEXITCODE): $Script"
54    }
55}
56
57# Run a command in the default WSL distro as the default user, returning its
58# exit code instead of throwing.
59function Test-Wsl {
60    param([Parameter(Mandatory = $true)][string]$Script)
61    & wsl.exe -- sh -lc $Script *> $null
62    return $LASTEXITCODE
63}
64
65if (-not $NoProvision) {
66    Write-Host "==> Provisioning the default WSL distro for sandbox testing"
67
68    if ((Test-Wsl "command -v apt-get >/dev/null 2>&1") -eq 0) {
69        Write-Host "    Installing bubblewrap (apt-get)..."
70        Invoke-WslRoot "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y bubblewrap"
71    }
72    else {
73        Write-Warning "Auto-provisioning only supports apt-based distros. Install 'bubblewrap' in your default WSL distro manually, then re-run with -NoProvision."
74    }
75
76    Write-Host "    Enabling unprivileged user namespaces (for this WSL VM session)..."
77    # Older kernels lack this key (the AppArmor restriction simply isn't
78    # present), so don't treat a missing key as an error.
79    Invoke-WslRoot "sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true"
80}
81
82if ((Test-Wsl "command -v bwrap >/dev/null 2>&1") -ne 0) {
83    Write-Warning "bwrap is not installed in the default WSL distro; the sandbox cannot be enforced. Install 'bubblewrap' (or run without -NoProvision)."
84}
85
86$repoRoot = Split-Path -Parent $PSScriptRoot
87Push-Location $repoRoot
88try {
89    $xtaskArgs = @("xtask", "wsl-sandbox-tests")
90    if (-not $AllowSkip) { $xtaskArgs += "--require-enforced" }
91    if ($Release) { $xtaskArgs += "--release" }
92
93    Write-Host "==> Running: cargo $($xtaskArgs -join ' ')"
94    & cargo @xtaskArgs
95    $exitCode = $LASTEXITCODE
96}
97finally {
98    Pop-Location
99}
100
101exit $exitCode
102