tenant.openagents/omega

1#![allow(clippy::disallowed_methods, reason = "tooling is exempt")]
2
3use std::process::Command;
4
5use anyhow::{Context as _, Result, bail};
6use clap::Parser;
7
8/// Runs the Windows WSL Bubblewrap sandbox behavior tests — the Windows analog
9/// of `cargo xtask sandbox-tests`.
10///
11/// Where the Linux tests boot a NixOS VM, here we build and run
12/// `wsl_sandbox_test_helper` (sandbox crate, `wsl-test` feature), which drives
13/// the real `windows_wsl::wrap_invocation`, spawns the resulting `wsl.exe`
14/// command, and asserts the sandbox's grants and restrictions hold end-to-end.
15///
16/// This must run on Windows with WSL, against a default distro that has
17/// `bubblewrap` installed and unprivileged user namespaces enabled.
18/// `script/test-wsl-sandbox.ps1` can provision that environment and invoke this.
19#[derive(Parser)]
20pub struct WslSandboxTestsArgs {
21    /// Fail (rather than skip the enforcement checks) when the sandbox can't
22    /// actually be enforced. Use this once the WSL environment is provisioned,
23    /// so a broken sandbox is caught instead of silently skipped.
24    #[arg(long)]
25    require_enforced: bool,
26
27    /// Build and run the helper in release mode.
28    #[arg(long)]
29    release: bool,
30}
31
32pub fn run_wsl_sandbox_tests(args: WslSandboxTestsArgs) -> Result<()> {
33    if !cfg!(target_os = "windows") {
34        bail!(
35            "wsl-sandbox-tests drives the Windows WSL sandbox and must run on Windows with WSL \
36             installed. See script/test-wsl-sandbox.ps1."
37        );
38    }
39
40    let mut command = Command::new("cargo");
41    command.args([
42        "run",
43        "-p",
44        "sandbox",
45        "--features",
46        "wsl-test",
47        "--bin",
48        "wsl_sandbox_test_helper",
49    ]);
50    if args.release {
51        command.arg("--release");
52    }
53    if args.require_enforced {
54        command.env("ZED_TEST_SANDBOX_REQUIRE_ENFORCED", "1");
55    }
56
57    eprintln!("Running WSL sandbox behavior tests");
58    let status = command
59        .status()
60        .context("failed to run `cargo run` for the WSL sandbox helper")?;
61    if !status.success() {
62        bail!("WSL sandbox tests failed");
63    }
64    Ok(())
65}
66