Cleanup capabilities

.sloptrap

@@ -1,4 +1,4 @@
 name=skz-sloptrap
 packages_extra=bash make shellcheck jq podman iproute2 strace
-capabilities=apt-install nested-podman packet-capture
+capabilities=
 allow_host_network=false

AGENTS.md

@@ -3,16 +3,6 @@
 This workspace is the source code of `sloptrap`, eg. your own runtime.
 Your author, 'sk4nz', has ran the command `sloptrap path/to/skz-sloptrap` and you are living in your own reflection.
 
-# Recursive `slopsloptrap`
-
-sloptrap can recurse.
-
-If you need to prove it, spawn a child from this repo with sloptrap:
-
-`./sloptrap /workspace ...`
-
-This starts a child `slopsloptrap`. Use the child normally, as the end-user would.
-
 # Keep Memory
 
 Future sloptrap instances should add short, useful, durable notes they learn during their session to this file.
@@ -24,19 +14,9 @@ Do not remove existing instructions unless they are outdated or wrong.
 ---
 # Session Memory
 
-- When you make changes that affect how the runtime behaves and cannot test it with recursion, you can ask sk4nz to restart you.
-- If recursion is blocked by the current session state and a restart is required, give sk4nz an exact prompt to paste into the next restarted session so it can continue from the current checkpoint.
+- When runtime changes need a fresh sloptrap session to validate, ask sk4nz to restart you and give an exact prompt to continue from the current checkpoint.
 - Useful checks in the skz-sloptrap repo:
   `shellcheck sloptrap`
   `bash tests/run_tests.sh` (you can also run them separately)
-- Recursive nested-podman inside an already user-namespaced sloptrap needs subuid/subgid ranges derived from `/proc/self/uid_map` and `/proc/self/gid_map`; hardcoding `100000:65536` breaks `newuidmap`.
 - When running tests from inside sloptrap, inherited `CODEX_HOME=/codex` plus `SLOPTRAP_PREFER_CODEX_HOME=1` can leak into host-style child launches; ignore that preference when `HOME` has been redirected elsewhere and the runtime hints still point into the inherited `/codex` tree.
-- For real recursive `./sloptrap` launches, correct `/proc/self/uid_map` alone is not enough: if the current session still has stale read-only `/etc/subuid` and `/etc/subgid` mounts (for example `sk4nz:100000:65536`), the first nested podman launch still fails before child startup.
-- Forcing `SLOPTRAP_CONTAINER_ENGINE=sloppodman` inside sloptrap also needs `TMPDIR` under `/workspace`; otherwise its build-context path guard rejects the staged Dockerfile under `/tmp` before you reach the real subuid/subgid problem.
-- If a restarted session still inherits stale read-only `/etc/subuid` and `/etc/subgid` tmpfs mounts, an unprivileged agent cannot repair them in-place (`umount` says `must be superuser to unmount`); both podman and sloppodman stay blocked until the session starts without those mounts.
-- Outer sloptrap launches no longer need `/etc/subuid` or `/etc/subgid` bind mounts: `nested-podman` now disables read-only rootfs and the container entrypoint synthesizes container-local subid files from `/proc/self/{uid,gid}_map` before dropping privileges.
-- Even without stale `/etc/subuid` mounts, recursion still fails if the container-local subid files name `sloptrap` instead of the real dropped user (`sk4nz` here): `podman info --debug` warns `no subuid ranges found for user "sk4nz"` and the first inner build dies in `newuidmap ... write to uid_map failed: Operation not permitted`.
-- In this Debian 13 / podman 5.4.2 environment, exporting `_CONTAINERS_USERNS_CONFIGURED=done` for nested podman moves the failure past `newuidmap`, but the next blockers are inside Buildah: with `BUILDAH_ISOLATION=chroot`, recursive builds fail `cannot set --network other than host with --isolation chroot`; without chroot, `podman build` can segfault in `network.defaultNetworkBackend`.
-- Recursive preload now has a host-side path: the outer launcher saves `$SLOPTRAP_IMAGE_NAME` into capability state and mounts it into the container as `SLOPTRAP_RECURSIVE_PARENT_IMAGE_ARCHIVE=/codex/capabilities/podman/preload/<image>.tar`, and child `build-if-missing` tries `sloppodman load -i` before any inner build. A pre-existing session must be restarted to test that path because it cannot add the new preload mount/env to itself after startup.
-- With stale subid mounts gone, recursive `./sloptrap /workspace` can still fail earlier during the inner image build: `crun` tries to open `/proc/sys/net/ipv4/ping_group_range` and gets `Read-only file system` while creating the build container.
-- In a fragile nested-podman session, `podman system migrate` can make things worse: a state that still answered `podman info` fell back to repeated `newuidmap ... write to uid_map failed: Operation not permitted` failures afterward.
+- Capability-enabled runs are Podman-only. `packet-capture` uses a dedicated helper container/pod, and host-network capture must prompt for an explicit acknowledgement on every runtime launch.

README.md

@@ -62,13 +62,13 @@ Supported keys when the manifest is present:
 | --- | --- | --- |
 | `name` | project directory name | Must match `^[A-Za-z0-9_.-]+$`. Used for image/container naming. |
 | `packages_extra` | *empty* | Additional Debian packages installed during `docker/podman build`. Tokens must be alphanumeric plus `+.-`. |
-| `capabilities` | *empty* | Optional privileged features. Supported values are `apt-install`, `packet-capture`, and `nested-podman`. |
+| `capabilities` | *empty* | Optional privileged features. Supported values are `apt-install` and `packet-capture`. Capability-enabled runs require Podman. When `packet-capture` is combined with `allow_host_network=true`, sloptrap shows a runtime warning with concrete consequences and requires an interactive acknowledgement on every run. |
 | `allow_host_network` | `false` | `true` opts into `--network host`; keep `false` unless the project absolutely requires direct access to host-local services. |
 
 Values containing `$`, `` ` ``, or newlines are rejected to prevent command injection. Setting illegal keys or malformed values aborts the run before containers start.
 sloptrap always runs Codex with `--sandbox danger-full-access --ask-for-approval never`. `codex_args` is deprecated and rejected if present.
 
-Capability trust is local state, not part of the repository. Builds for manifests that request capabilities require either an interactive trust confirmation or `--trust-capabilities`. Once the current manifest is trusted, its requested capabilities are enabled automatically for that project configuration.
+Capability trust is local state, not part of the repository. Builds for manifests that request capabilities require either an interactive trust confirmation or `--trust-capabilities`. Once the current manifest is trusted, its requested capabilities are enabled automatically for that project configuration. The `allow_host_network=true` plus `packet-capture` combination still requires a separate interactive acknowledgement each time a runtime container is launched.
 
 ### `.sloptrapignore`
 
@@ -130,26 +130,24 @@ The launcher executes targets sequentially, so `./sloptrap repo build run` perfo
 When the current manifest's capabilities are trusted and enabled, the container includes helper commands:
 
 - `slop-apt install <package...>` for session-scoped package installation.
-- `slopcap capture --interface <iface> [--filter <expr>] [--output <path>] [--stdout]` for packet capture.
-- `sloppodman <pull|build|tag|run|ps|logs|stop|rm|inspect> ...` for nested Podman workflows. `build` contexts and Dockerfiles must remain inside `/workspace`, and pushes are not supported.
-- When `nested-podman` is enabled, sloptrap makes the container root filesystem writable long enough to synthesize container-local `/etc/subuid` and `/etc/subgid` files from the live namespace maps, so rootless nested Podman does not depend on host subid files.
+- `slopcap capture --interface <iface> [--filter <expr>] [--output <path>] [--stdout]` for non-promiscuous packet capture through a dedicated helper container. Host-network captures require an explicit acknowledgement each run.
 
 ## Execution Environment
 
-- Container engine: Podman or Docker with identical command lines. Podman uses `--userns=keep-id`; Docker receives the equivalent `--user UID:GID` for standard runs.
+- Container engine: Podman or Docker for standard runs. Capability-enabled runs require Podman. Podman uses `--userns=keep-id`; Docker receives the equivalent `--user UID:GID` for standard runs.
 - Filesystem view: the project directory mounts at `/workspace`; `${HOME}/.codex/sloptrap/state/<project-hash>` mounts at `/codex`; `${HOME}/.codex/auth.json` mounts at `/codex/auth.json`.
 - Ignore filter: `.sloptrapignore` entries are overlaid with tmpfs directories or empty bind mounts so data remains unavailable to Codex.
-- Network: isolated networking is used by default; `allow_host_network=true` opts into `--network host`.
+- Network: isolated networking is used by default; `allow_host_network=true` opts into `--network host`. When `packet-capture` is enabled, sloptrap starts a separate capture helper container in the same Podman pod so the main Codex container does not receive `NET_RAW`.
 - Process context: standard runs drop capabilities, set `no-new-privileges`, use a read-only root filesystem, and keep scratch paths (`/tmp`, `/run`, `/run/lock`) on tmpfs. Capability-enabled runs may selectively add the runtime options required for the requested capability.
-- Codex configuration: runtime flags are fixed to `--sandbox danger-full-access --ask-for-approval never`. Persistent Codex state is project-scoped under `${HOME}/.codex/sloptrap/state/`, while credentials are shared via `${HOME}/.codex/auth.json`.
+- Codex configuration: runtime flags are fixed to `--sandbox danger-full-access --ask-for-approval never`. Persistent Codex state is project-scoped under `${HOME}/.codex/sloptrap/state/`, while credentials are shared via `${HOME}/.codex/auth.json` and mounted read-only except during the `login` target.
 
 ## Threat Model and Limits
 
 - **Outbound disclosure**: prompts and referenced data travel from the container to the configured LLM endpoint. Any file content within `/workspace` or environment data exposed to the process can appear in that traffic.
 - **Shared storage**: `/workspace`, project-scoped `/codex`, and `/codex/auth.json` are host mounts. Files written to these locations become visible on the host and to the LLM provider through prompts.
 - **Environment surface**: the container receives a minimal fixed environment (HOME/XDG paths, `CODEX_HOME`). The manifest no longer allows injecting additional environment variables.
-- **Process isolation**: standard runs keep a read-only root filesystem and no extra Linux capabilities. Capability-enabled runs deliberately relax specific runtime controls for the enabled feature, so they should be treated as a stronger trust decision than a default session.
-- **Networking stance**: traffic is unrestricted once it leaves the container. sloptrap does not enforce an allowlist or DNS policy. Host networking is opt-in per manifest; if you require an offline or firewalled workflow, sloptrap is not an appropriate launcher.
+- **Process isolation**: standard runs keep a read-only root filesystem and no extra Linux capabilities. Capability-enabled runs deliberately relax specific runtime controls for the enabled feature, so they should be treated as a stronger trust decision than a default session. `packet-capture` now runs in a dedicated helper container so the main Codex container does not hold raw-socket capability.
+- **Networking stance**: traffic is unrestricted once it leaves the container. sloptrap does not enforce an allowlist or DNS policy. Host networking is opt-in per manifest; when it is combined with `packet-capture`, sloptrap warns and requires an explicit acknowledgement for each runtime launch because the capture helper will have raw packet access in the host namespace and may observe plaintext traffic or inject spoofed packets. If you require an offline or firewalled workflow, sloptrap is not an appropriate launcher.
 - **Persistence**: Codex history and logs accumulate per project under `${HOME}/.codex/sloptrap/state/`. Sensitive prompts recorded on disk remain on the host after the session. Because `.git/` is ignored inside the container, any historical secrets in Git objects stay outside the LLM context unless explicitly surfaced in the working tree.
 - **Codex cache hygiene**: per-project state mounts remain writable by the container and hold prompts/history/state, while `${HOME}/.codex/auth.json` holds shared credentials. Rotate credentials regularly and protect both locations.
 - **Secret scanning**: sloptrap does not perform secret discovery or redaction; any credentials present in the project remain available to Codex and the upstream provider.

slopsloptrap/.sloptrap

@@ -1,3 +0,0 @@
-name=slopsloptrap
-capabilities=nested-podman
-allow_host_network=false

tests/README.md

@@ -14,3 +14,4 @@ Current scenarios:
 - `auth_file_mount` — verifies `~/.codex/auth.json` is mounted directly into `/codex/auth.json`.
 - `project_state_isolation` — verifies different projects map `/codex` to different host state directories.
 - `auto_login_empty_auth` — verifies an empty `auth.json` still triggers automatic login before the main target.
+- `host_network_packet_capture/` — exercises the per-run acknowledgement path for host networking combined with `packet-capture`.

tests/capability_repo/.sloptrap

@@ -1,3 +1,3 @@
 name=capability-repo
-capabilities=apt-install packet-capture nested-podman
-allow_host_network=true
+capabilities=apt-install packet-capture
+allow_host_network=false

tests/host_network_packet_capture/.sloptrap

@@ -0,0 +1,3 @@
+name=host-network-packet-capture
+capabilities=packet-capture
+allow_host_network=true

tests/host_network_repo/.sloptrap

@@ -0,0 +1,3 @@
+name=host-network-repo
+capabilities=apt-install
+allow_host_network=true

tests/run_tests.sh

@@ -97,6 +97,47 @@ verify_secret_mounts() {
   return 0
 }
 
+maybe_create_helper_pidfile() {
+  local -a args=("$@")
+  local codex_source=""
+  local helper_dir=""
+  local idx=0
+  while (( idx < ${#args[@]} )); do
+    local arg=${args[$idx]}
+    case "$arg" in
+      -v)
+        idx=$((idx + 1))
+        if (( idx < ${#args[@]} )); then
+          local spec=${args[$idx]}
+          case "$spec" in
+            *:/codex|*:/codex:* )
+              codex_source=${spec%%:/codex*}
+              ;;
+          esac
+        fi
+        ;;
+      -e)
+        idx=$((idx + 1))
+        if (( idx < ${#args[@]} )); then
+          local envspec=${args[$idx]}
+          case "$envspec" in
+            SLOPTRAP_HELPER_DIR=*)
+              helper_dir=${envspec#SLOPTRAP_HELPER_DIR=}
+              ;;
+          esac
+        fi
+        ;;
+    esac
+    idx=$((idx + 1))
+  done
+  if [[ -z $codex_source || $helper_dir != /codex/* ]]; then
+    return 0
+  fi
+  local helper_host=${codex_source}/${helper_dir#/codex/}
+  mkdir -p "$helper_host"
+  printf '12345\n' >"$helper_host/helperd.pid"
+}
+
 if [[ ${1-} == "image" && ${2-} == "inspect" && ${FAKE_PODMAN_INSPECT_FAIL:-0} == 1 ]]; then
   if [[ " $* " == *" --format "* ]]; then
     printf 'fake-image-id\n'
@@ -113,10 +154,16 @@ if [[ ${SECRET_MASK_VERIFY:-0} == 1 && ${1-} == "run" ]]; then
   fi
 fi
 
+if [[ ${1-} == "run" ]]; then
+  maybe_create_helper_pidfile "$@"
+fi
+
 echo "FAKE PODMAN: $*" >>"$FAKE_PODMAN_LOG"
 exit 0
 EOF
   chmod +x "$STUB_BIN/podman"
+  cp "$STUB_BIN/podman" "$STUB_BIN/docker"
+  chmod +x "$STUB_BIN/docker"
   cat >"$STUB_BIN/curl" <<'EOF'
 #!/usr/bin/env bash
 set -euo pipefail
@@ -367,7 +414,7 @@ run_resume_target() {
 }
 
 run_runtime_context_prompt() {
-  local scenario_dir="$TEST_ROOT/capability_repo"
+  local scenario_dir="$TEST_ROOT/host_network_repo"
   printf '==> runtime_context_prompt\n'
   setup_stub_env
   if ! PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" FAKE_PODMAN_LOG="$STUB_LOG" FAKE_PODMAN_INSPECT_FAIL=1 \
@@ -382,8 +429,8 @@ run_runtime_context_prompt() {
   if [[ -z $run_line || $run_line != *"You are running inside sloptrap"* ]]; then
     record_failure "runtime_context_prompt: startup prompt missing from fresh run"
   fi
-  if ! grep -q -- "name=capability-repo" "$STUB_LOG" \
-    || ! grep -q -- "enabled_capabilities=apt-install nested-podman packet-capture" "$STUB_LOG" \
+  if ! grep -q -- "name=host-network-repo" "$STUB_LOG" \
+    || ! grep -q -- "enabled_capabilities=apt-install" "$STUB_LOG" \
     || ! grep -q -- "network_mode=host" "$STUB_LOG"; then
     record_failure "runtime_context_prompt: runtime summary missing manifest or capability state"
   fi
@@ -394,7 +441,7 @@ run_runtime_context_prompt() {
 }
 
 run_sh_reexec() {
-  local scenario_dir="$TEST_ROOT/capability_repo"
+  local scenario_dir="$TEST_ROOT/host_network_repo"
   printf '==> sh_reexec\n'
   setup_stub_env
   if ! PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" FAKE_PODMAN_LOG="$STUB_LOG" FAKE_PODMAN_INSPECT_FAIL=1 \
@@ -410,7 +457,7 @@ run_sh_reexec() {
 }
 
 run_resume_omits_runtime_context() {
-  local scenario_dir="$TEST_ROOT/capability_repo"
+  local scenario_dir="$TEST_ROOT/host_network_repo"
   local session_id="019a81b7-32d2-7622-8639-6698c6579625"
   printf '==> resume_omits_runtime_context\n'
   setup_stub_env
@@ -442,8 +489,8 @@ run_auth_file_mount() {
     teardown_stub_env
     return
   fi
-  if ! grep -q -- "-v ${STUB_HOME}/.codex/auth.json:/codex/auth.json:Z" "$STUB_LOG"; then
-    record_failure "auth_file_mount: missing auth file bind mount"
+  if ! grep -q -- "-v ${STUB_HOME}/.codex/auth.json:/codex/auth.json:Z,ro" "$STUB_LOG"; then
+    record_failure "auth_file_mount: auth file should be mounted read-only for normal runs"
   fi
   if ! grep -q -- "-v ${STUB_HOME}/.codex/sloptrap/state/" "$STUB_LOG"; then
     record_failure "auth_file_mount: missing project state bind mount"
@@ -466,8 +513,8 @@ run_codex_home_override() {
     teardown_stub_env
     return
   fi
-  if ! grep -q -- "-v ${codex_root}/auth.json:/codex/auth.json:Z" "$STUB_LOG"; then
-    record_failure "codex_home_override: missing CODEX_HOME auth file mount"
+  if ! grep -q -- "-v ${codex_root}/auth.json:/codex/auth.json:Z,ro" "$STUB_LOG"; then
+    record_failure "codex_home_override: CODEX_HOME auth file should be mounted read-only for normal runs"
   fi
   if ! grep -q -- "-v ${codex_root}/sloptrap/state/" "$STUB_LOG"; then
     record_failure "codex_home_override: missing CODEX_HOME project state bind mount"
@@ -483,170 +530,25 @@ run_codex_home_override() {
   teardown_stub_env
 }
 
-run_recursive_slopsloptrap() {
-  local scenario_dir temp_root codex_root
-  printf '==> recursive_slopsloptrap\n'
-  setup_stub_env
-  temp_root=$(mktemp -d)
-  scenario_dir="$temp_root/slopsloptrap"
-  codex_root="$temp_root/codex-root"
-  mkdir -p "$scenario_dir" "$codex_root"
+run_removed_nested_podman_manifest() {
+  local scenario_dir output_log
+  scenario_dir=$(mktemp -d)
+  output_log=$(mktemp)
+  printf '==> removed_nested_podman_manifest\n'
   cat >"$scenario_dir/.sloptrap" <<'EOF'
-name=slopsloptrap
-capabilities=nested-podman
-allow_host_network=false
-EOF
-  printf '{"access_token":"test"}\n' >"$codex_root/auth.json"
-  if ! PATH="$STUB_BIN:$PATH" HOME="$codex_root" CODEX_HOME="$codex_root" \
-    FAKE_PODMAN_LOG="$STUB_LOG" FAKE_PODMAN_INSPECT_FAIL=1 \
-    "$SLOPTRAP_BIN" --trust-capabilities "$scenario_dir" shell </dev/null >/dev/null 2>&1; then
-    record_failure "recursive_slopsloptrap: sloptrap exited non-zero"
-    teardown_stub_env
-    rm -rf "$temp_root"
-    return
-  fi
-  if ! grep -q -- "slopsloptrap-sloptrap-image" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: child image name missing"
-  fi
-  if ! grep -q -- "slopsloptrap-sloptrap-container" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: child container name missing"
-  fi
-  if ! grep -q -- "-v ${codex_root}/auth.json:/codex/auth.json:Z" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: missing recursive auth bind mount"
-  fi
-  if ! grep -q -- "/capabilities/podman-preload:/codex/capabilities/podman/preload:Z" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: missing recursive preload bind mount"
-  fi
-  if ! grep -q -- "-v ${codex_root}/sloptrap/state/" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: missing recursive state bind mount"
-  fi
-  if ! grep -q -- "SLOPTRAP_RECURSIVE_PARENT_IMAGE_ARCHIVE=/codex/capabilities/podman/preload/slopsloptrap-sloptrap-image.tar" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: missing recursive preload archive environment"
-  fi
-  if grep -q -- "-v ${codex_root}/.codex/auth.json:/codex/auth.json:Z" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: should not fall back to CODEX_HOME/.codex in recursive mode"
-  fi
-  if grep -q -- "/etc/subuid" "$STUB_LOG" || grep -q -- "/etc/subgid" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: launcher should not mount subid helper files"
-  fi
-  if grep -q -- "--read-only" "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: nested podman should disable read-only rootfs"
-  fi
-  local first_run
-  first_run=$(grep "FAKE PODMAN: run " "$STUB_LOG" | head -n 1 || true)
-  if [[ -z $first_run || $first_run == *" login" ]]; then
-    record_failure "recursive_slopsloptrap: recursive auth should avoid login target"
-  fi
-  if ! grep -q -- "FAKE PODMAN: save -o " "$STUB_LOG"; then
-    record_failure "recursive_slopsloptrap: should export the parent image for recursive preload"
-  fi
-  if [[ $first_run != *"/bin/bash"* ]]; then
-    record_failure "recursive_slopsloptrap: shell target did not reach child container run"
-  fi
-  if [[ $first_run == *"--user "* ]]; then
-    record_failure "recursive_slopsloptrap: nested podman shell should not force --user"
-  fi
-  if [[ $first_run != *"--cap-add SETUID"* || $first_run != *"--cap-add SETGID"* ]]; then
-    record_failure "recursive_slopsloptrap: nested podman shell missing privilege bootstrap capabilities"
-  fi
-  teardown_stub_env
-  rm -rf "$temp_root"
-}
-
-run_recursive_parent_image_fallback() {
-  printf '==> recursive_parent_image_fallback\n'
-  local temp_root helper_bin scenario_dir archive_path tool_log
-  local inner_podman_root inner_podman_runroot inner_runtime_dir
-  temp_root=$(mktemp -d)
-  helper_bin="$temp_root/bin"
-  scenario_dir="$temp_root/fallback-repo"
-  archive_path="$scenario_dir/parent-runtime.tar"
-  tool_log="$temp_root/tool.log"
-  inner_podman_root="$temp_root/podman-storage"
-  inner_podman_runroot="$temp_root/podman-run"
-  inner_runtime_dir="$temp_root/podman-runtime"
-  mkdir -p "$helper_bin" "$scenario_dir" "$inner_podman_root" "$inner_podman_runroot" "$inner_runtime_dir"
-  : >"$tool_log"
-
-  cat >"$scenario_dir/.sloptrap" <<'EOF'
-name=fallback-repo
+name=removed-nested-podman
 capabilities=nested-podman
 EOF
-  printf 'archive\n' >"$archive_path"
-
-  if ! extract_embedded_helper "sloppodman" "$helper_bin/sloppodman"; then
-    record_failure "recursive_parent_image_fallback: failed to extract sloppodman helper"
-    rm -rf "$temp_root"
-    return
+  if "$SLOPTRAP_BIN" --dry-run "$scenario_dir" >/dev/null 2>&1; then
+    record_failure "removed_nested_podman_manifest: expected nested-podman manifest rejection"
   fi
-
-  cat >"$helper_bin/podman" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'podman %s\n' "$*" >>"$TEST_TOOL_LOG"
-args=("$@")
-idx=0
-loaded_flag="${TEST_TOOL_LOG}.loaded"
-while (( idx < ${#args[@]} )); do
-  if [[ ${args[$idx]} == "image" ]] && (( idx + 1 < ${#args[@]} )) && [[ ${args[$((idx + 1))]} == "inspect" ]]; then
-    if [[ -f $loaded_flag ]]; then
-      exit 0
+  if ! "$SLOPTRAP_BIN" --dry-run "$scenario_dir" >"$output_log" 2>&1; then
+    if ! grep -q -- "capability 'nested-podman' was removed" "$output_log"; then
+      record_failure "removed_nested_podman_manifest: missing explicit removal error"
     fi
-    exit 1
   fi
-  if [[ ${args[$idx]} == "load" ]]; then
-    : >"$loaded_flag"
-    exit 0
-  fi
-  ((idx+=1))
-done
-exit 0
-EOF
-  cat >"$helper_bin/setpriv" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --reuid|--regid)
-      shift 2
-      ;;
-    --clear-groups)
-      shift
-      ;;
-    --)
-      shift
-      break
-      ;;
-    *)
-      break
-      ;;
-  esac
-done
-exec "$@"
-EOF
-  chmod +x "$helper_bin/sloppodman" "$helper_bin/podman" "$helper_bin/setpriv"
-
-  if ! TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" HOME="$temp_root/home" CODEX_HOME="$temp_root/home" \
-    SLOPTRAP_CONTAINER_ENGINE="sloppodman" \
-    SLOPTRAP_ACTIVE_CAPABILITIES="nested-podman" \
-    SLOPTRAP_WORKDIR="$scenario_dir" \
-    SLOPTRAP_RECURSIVE_PARENT_IMAGE_ARCHIVE="$archive_path" \
-    SLOPTRAP_INNER_PODMAN_ROOT="$inner_podman_root" \
-    SLOPTRAP_INNER_PODMAN_RUNROOT="$inner_podman_runroot" \
-    XDG_RUNTIME_DIR="$inner_runtime_dir" \
-    "$SLOPTRAP_BIN" --trust-capabilities "$scenario_dir" build-if-missing >/dev/null 2>&1; then
-    record_failure "recursive_parent_image_fallback: build-if-missing exited non-zero"
-    rm -rf "$temp_root"
-    return
-  fi
-  if grep -q -- 'podman --root .* build ' "$tool_log"; then
-    record_failure "recursive_parent_image_fallback: fallback should avoid podman build"
-  fi
-  if ! grep -q -- "podman --root $inner_podman_root --runroot $inner_podman_runroot --storage-driver vfs --cgroup-manager cgroupfs --events-backend file load -i $archive_path" "$tool_log"; then
-    record_failure "recursive_parent_image_fallback: fallback did not load the parent archive into the nested store"
-  fi
-
-  rm -rf "$temp_root"
+  rm -f "$output_log"
+  rm -rf "$scenario_dir"
 }
 
 run_project_state_isolation() {
@@ -709,8 +611,11 @@ run_auto_login_empty_auth() {
   if [[ -z $first_run || $first_run != *" login" ]]; then
     record_failure "auto_login_empty_auth: expected login before primary run"
   fi
-  if ! grep -q -- "-v ${STUB_HOME}/.codex/auth.json:/codex/auth.json:Z" "$STUB_LOG"; then
-    record_failure "auto_login_empty_auth: missing auth file bind mount"
+  if [[ -z $first_run || $first_run != *"-v ${STUB_HOME}/.codex/auth.json:/codex/auth.json:Z "* ]]; then
+    record_failure "auto_login_empty_auth: login target should keep auth file writable"
+  fi
+  if ! grep -q -- "-v ${STUB_HOME}/.codex/auth.json:/codex/auth.json:Z,ro" "$STUB_LOG"; then
+    record_failure "auto_login_empty_auth: post-login runtime should remount auth file read-only"
   fi
   teardown_stub_env
 }
@@ -832,6 +737,53 @@ run_invalid_allow_host_network() {
   fi
 }
 
+run_host_network_packet_capture_ack_required() {
+  local scenario_dir="$TEST_ROOT/host_network_packet_capture"
+  printf '==> host_network_packet_capture_ack_required\n'
+  local output_log
+  output_log=$(mktemp)
+  setup_stub_env
+  if PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" FAKE_PODMAN_LOG="$STUB_LOG" FAKE_PODMAN_INSPECT_FAIL=1 \
+    "$SLOPTRAP_BIN" --trust-capabilities "$scenario_dir" </dev/null >"$output_log" 2>&1; then
+    record_failure "host_network_packet_capture_ack_required: expected failure without interactive acknowledgement"
+  fi
+  if grep -q -- "FAKE PODMAN: run " "$STUB_LOG"; then
+    record_failure "host_network_packet_capture_ack_required: runtime container should not start without acknowledgement"
+  fi
+  teardown_stub_env
+  rm -f "$output_log"
+}
+
+run_host_network_packet_capture_ack_prompt() {
+  local scenario_dir="$TEST_ROOT/host_network_packet_capture"
+  printf '==> host_network_packet_capture_ack_prompt\n'
+  if ! can_run_script_pty; then
+    printf 'skipping host_network_packet_capture_ack_prompt: script PTY support not available\n'
+    return
+  fi
+  local output_log
+  output_log=$(mktemp)
+  setup_stub_env
+  if ! printf 'y\n' | script -q -c "env PATH=\"$STUB_BIN:$PATH\" HOME=\"$STUB_HOME\" FAKE_PODMAN_LOG=\"$STUB_LOG\" FAKE_PODMAN_INSPECT_FAIL=1 \"$SLOPTRAP_BIN\" --trust-capabilities \"$scenario_dir\"" "$output_log" >/dev/null 2>&1; then
+    record_failure "host_network_packet_capture_ack_prompt: interactive acknowledgement should allow the run"
+    teardown_stub_env
+    rm -f "$output_log"
+    return
+  fi
+  if [[ $(grep -c -- 'Continue with host-network packet capture for this run' "$output_log" || true) -ne 1 ]]; then
+    record_failure "host_network_packet_capture_ack_prompt: expected a single runtime acknowledgement prompt"
+  fi
+  if ! grep -q -- 'capture host-network traffic' "$output_log" \
+    || ! grep -q -- 'transmit spoofed packets' "$output_log"; then
+    record_failure "host_network_packet_capture_ack_prompt: warning should describe concrete consequences"
+  fi
+  if ! grep -q -- "--network host" "$STUB_LOG"; then
+    record_failure "host_network_packet_capture_ack_prompt: host networking run did not reach the container engine"
+  fi
+  teardown_stub_env
+  rm -f "$output_log"
+}
+
 run_wizard_create_manifest() {
   local scenario_dir="$TEST_ROOT/wizard_empty"
   printf '==> wizard_create_manifest\n'
@@ -881,7 +833,7 @@ run_wizard_existing_defaults() {
   if ! grep -qx "packages_extra=make git" "$scenario_dir/.sloptrap"; then
     record_failure "wizard_existing_defaults: packages_extra not preserved"
   fi
-  if ! grep -qx "capabilities=apt-install packet-capture" "$scenario_dir/.sloptrap"; then
+  if ! grep -qx "capabilities=apt-install" "$scenario_dir/.sloptrap"; then
     record_failure "wizard_existing_defaults: capabilities not preserved"
   fi
   if ! grep -qx "allow_host_network=true" "$scenario_dir/.sloptrap"; then
@@ -924,69 +876,99 @@ run_capability_trust_required() {
   teardown_stub_env
 }
 
+run_capabilities_require_podman() {
+  local scenario_dir="$TEST_ROOT/capability_repo"
+  printf '==> capabilities_require_podman\n'
+  local output_log
+  output_log=$(mktemp)
+  setup_stub_env
+  if PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" SLOPTRAP_CONTAINER_ENGINE=docker \
+    "$SLOPTRAP_BIN" --dry-run "$scenario_dir" >"$output_log" 2>&1; then
+    record_failure "capabilities_require_podman: expected docker capability run to be rejected"
+  elif ! grep -q -- 'capability-enabled runs require podman' "$output_log"; then
+    record_failure "capabilities_require_podman: missing explicit podman requirement"
+  fi
+  teardown_stub_env
+  rm -f "$output_log"
+}
+
 run_capability_profiles() {
   local scenario_dir="$TEST_ROOT/capability_repo"
   printf '==> capability_profiles\n'
   setup_stub_env
+  local main_lines capture_lines pod_lines
+  local expected_build_network="bridge"
+  if command -v slirp4netns >/dev/null 2>&1; then
+    expected_build_network="slirp4netns"
+  fi
   if ! PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" FAKE_PODMAN_LOG="$STUB_LOG" FAKE_PODMAN_INSPECT_FAIL=1 \
     "$SLOPTRAP_BIN" --trust-capabilities "$scenario_dir" </dev/null >/dev/null 2>&1; then
     record_failure "capability_profiles: sloptrap exited non-zero"
     teardown_stub_env
     return
   fi
-  if ! grep -q -- "CAPABILITY_PACKAGES=tcpdump podman uidmap fuse-overlayfs slirp4netns" "$STUB_LOG"; then
+  if ! grep -q -- "CAPABILITY_PACKAGES=tcpdump" "$STUB_LOG"; then
     record_failure "capability_profiles: build arg for capability packages missing"
   fi
-  if ! grep -q -- "FAKE PODMAN: build --quiet -t capability-repo-sloptrap-image -f .* --network host " "$STUB_LOG"; then
-    record_failure "capability_profiles: build should inherit host networking"
+  if ! grep -q -- "FAKE PODMAN: build --quiet -t capability-repo-sloptrap-image -f .* --network $expected_build_network " "$STUB_LOG"; then
+    record_failure "capability_profiles: build should stay on isolated networking"
   fi
-  if ! grep -q -- "--cap-add NET_RAW" "$STUB_LOG"; then
-    record_failure "capability_profiles: NET_RAW capability missing"
+  main_lines=$(grep "FAKE PODMAN: run " "$STUB_LOG" | grep -- "--name capability-repo-sloptrap-container" || true)
+  capture_lines=$(grep "FAKE PODMAN: run " "$STUB_LOG" | grep -- "--name capability-repo-sloptrap-capture" || true)
+  pod_lines=$(grep "FAKE PODMAN: pod create " "$STUB_LOG" | grep -- "--name capability-repo-sloptrap-pod" || true)
+  if [[ -z $main_lines ]]; then
+    record_failure "capability_profiles: main runtime container did not reach the container engine"
   fi
-  if ! grep -q -- "--cap-add NET_ADMIN" "$STUB_LOG"; then
-    record_failure "capability_profiles: NET_ADMIN capability missing"
+  if [[ -z $pod_lines ]]; then
+    record_failure "capability_profiles: packet capture should create a dedicated pod"
   fi
-  if ! grep -q -- "--device /dev/fuse" "$STUB_LOG"; then
-    record_failure "capability_profiles: /dev/fuse device missing"
+  if [[ -z $capture_lines || $capture_lines != *"--cap-add NET_RAW"* ]]; then
+    record_failure "capability_profiles: capture sidecar should receive NET_RAW"
   fi
-  if ! grep -q -- "--cap-add SYS_CHROOT" "$STUB_LOG"; then
-    record_failure "capability_profiles: SYS_CHROOT capability missing"
+  if [[ -n $main_lines && $main_lines == *"--cap-add NET_RAW"* ]]; then
+    record_failure "capability_profiles: main container should not receive NET_RAW"
   fi
-  if ! grep -q -- "--cap-add MKNOD" "$STUB_LOG"; then
-    record_failure "capability_profiles: MKNOD capability missing"
+  if grep -q -- "--cap-add NET_ADMIN" <<<"$capture_lines"; then
+    record_failure "capability_profiles: NET_ADMIN should not be granted"
   fi
-  if ! grep -q -- "--cap-add SETUID" "$STUB_LOG"; then
+  if [[ -z $capture_lines || $capture_lines != *"--cap-add SETUID"* ]]; then
     record_failure "capability_profiles: SETUID capability missing"
   fi
-  if ! grep -q -- "--cap-add SETGID" "$STUB_LOG"; then
+  if [[ -z $capture_lines || $capture_lines != *"--cap-add SETGID"* ]]; then
     record_failure "capability_profiles: SETGID capability missing"
   fi
-  if ! grep -q -- "--cap-add CHOWN" "$STUB_LOG"; then
+  if [[ -z $capture_lines || $capture_lines != *"--cap-add CHOWN"* ]]; then
     record_failure "capability_profiles: CHOWN capability missing"
   fi
-  if ! grep -q -- "--cap-add DAC_OVERRIDE" "$STUB_LOG"; then
-    record_failure "capability_profiles: DAC_OVERRIDE capability missing"
+  if grep -q -- "--cap-add DAC_OVERRIDE" <<<"$capture_lines$main_lines"; then
+    record_failure "capability_profiles: DAC_OVERRIDE should not be granted"
   fi
-  if ! grep -q -- "--cap-add FOWNER" "$STUB_LOG"; then
-    record_failure "capability_profiles: FOWNER capability missing"
+  if grep -q -- "--cap-add FOWNER" <<<"$capture_lines$main_lines"; then
+    record_failure "capability_profiles: FOWNER should not be granted"
   fi
-  if ! grep -q -- "--security-opt seccomp=unconfined" "$STUB_LOG"; then
-    record_failure "capability_profiles: nested podman seccomp override missing"
+  if ! grep -q -- "--security-opt no-new-privileges" <<<"$capture_lines$main_lines"; then
+    record_failure "capability_profiles: no-new-privileges missing"
   fi
-  if grep -q -- "--security-opt no-new-privileges" "$STUB_LOG"; then
-    record_failure "capability_profiles: nested podman should not force no-new-privileges"
-  fi
-  if grep -q -- "--read-only" "$STUB_LOG"; then
+  if grep -q -- "--read-only" <<<"$main_lines"; then
     record_failure "capability_profiles: apt profile should disable read-only rootfs"
   fi
-  if grep -q -- "--user " "$STUB_LOG"; then
+  if grep -q -- "--user " <<<"$main_lines"; then
     record_failure "capability_profiles: capability-enabled run should not force --user"
   fi
-  if ! grep -q -- "--userns=keep-id:uid=$(id -u),gid=$(id -g)" "$STUB_LOG"; then
+  if ! grep -q -- "--userns=keep-id:uid=$(id -u),gid=$(id -g)" <<<"$capture_lines$main_lines"; then
     record_failure "capability_profiles: podman keep-id user namespace missing"
   fi
-  if ! grep -q -- "SLOPTRAP_ACTIVE_CAPABILITIES=apt-install nested-podman packet-capture" "$STUB_LOG"; then
-    record_failure "capability_profiles: active capability environment missing"
+  if ! grep -q -- "SLOPTRAP_ACTIVE_CAPABILITIES=apt-install" <<<"$main_lines"; then
+    record_failure "capability_profiles: main helper capability environment missing"
+  fi
+  if ! grep -q -- "SLOPTRAP_PACKET_CAPTURE_ENABLED=1" <<<"$main_lines"; then
+    record_failure "capability_profiles: main container should advertise packet capture availability"
+  fi
+  if ! grep -q -- "SLOPTRAP_HELPER_DIR=/codex/state/capture-helper" <<<"$capture_lines"; then
+    record_failure "capability_profiles: capture sidecar helper dir missing"
+  fi
+  if ! grep -q -- "SLOPTRAP_ACTIVE_CAPABILITIES=packet-capture" <<<"$capture_lines"; then
+    record_failure "capability_profiles: capture sidecar capability environment missing"
   fi
   if ! grep -q -- "SLOPTRAP_HOST_UID=$(id -u)" "$STUB_LOG"; then
     record_failure "capability_profiles: host uid environment missing"
@@ -997,27 +979,11 @@ run_capability_profiles() {
   if ! grep -q -- "SLOPTRAP_HOST_USER=$(id -un)" "$STUB_LOG"; then
     record_failure "capability_profiles: host user environment missing"
   fi
-  if ! grep -q -- "SLOPTRAP_INNER_PODMAN_HOST_NETWORK=1" "$STUB_LOG"; then
-    record_failure "capability_profiles: inner podman host-network mirror flag missing"
-  fi
-  if grep -q -- "/etc/subuid" "$STUB_LOG" || grep -q -- "/etc/subgid" "$STUB_LOG"; then
-    record_failure "capability_profiles: launcher should not mount subid helper files"
-  fi
   local state_root capability_dir
   state_root="$STUB_HOME/.codex/sloptrap/state"
   capability_dir=$(find "$state_root" -mindepth 2 -maxdepth 2 -type d -name capabilities | head -n 1 || true)
   if [[ -z $capability_dir ]]; then
     record_failure "capability_profiles: project capability state directory missing"
-  else
-    if [[ ! -d $capability_dir/podman-storage ]]; then
-      record_failure "capability_profiles: nested podman storage state missing"
-    fi
-    if [[ ! -d $capability_dir/podman-run ]]; then
-      record_failure "capability_profiles: nested podman runroot state missing"
-    fi
-    if [[ ! -d $capability_dir/podman-runtime ]]; then
-      record_failure "capability_profiles: nested podman runtime state missing"
-    fi
   fi
   teardown_stub_env
 }
@@ -1025,39 +991,25 @@ run_capability_profiles() {
 run_embedded_capability_helpers() {
   printf '==> embedded_capability_helpers\n'
   local temp_root helper_bin helper_dir workspace_dir capture_dir tool_log helper_pid
-  local inner_podman_root inner_podman_runroot inner_runtime_dir
   temp_root=$(mktemp -d)
   helper_bin="$temp_root/bin"
   helper_dir="$temp_root/helper"
   workspace_dir="$temp_root/workspace"
   capture_dir="$temp_root/captures"
   tool_log="$temp_root/tool.log"
-  inner_podman_root="$temp_root/podman-storage"
-  inner_podman_runroot="$temp_root/podman-run"
-  inner_runtime_dir="$temp_root/podman-runtime"
   helper_pid=""
-  mkdir -p "$helper_bin" "$helper_dir/queue" "$workspace_dir/data" "$capture_dir" \
-    "$inner_podman_root" "$inner_podman_runroot" "$inner_runtime_dir"
+  mkdir -p "$helper_bin" "$helper_dir/queue" "$workspace_dir/data" "$capture_dir"
   : >"$tool_log"
 
   if ! extract_embedded_helper "sloptrap-entrypoint" "$helper_bin/sloptrap-entrypoint" \
     || ! extract_embedded_helper "sloptrap-helperd" "$helper_bin/sloptrap-helperd" \
     || ! extract_embedded_helper "slop-apt" "$helper_bin/slop-apt" \
-    || ! extract_embedded_helper "slopcap" "$helper_bin/slopcap" \
-    || ! extract_embedded_helper "sloppodman" "$helper_bin/sloppodman"; then
+    || ! extract_embedded_helper "slopcap" "$helper_bin/slopcap"; then
     record_failure "embedded_capability_helpers: failed to extract embedded helper scripts"
     rm -rf "$temp_root"
     return
   fi
 
-cat >"$helper_bin/podman" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'podman-env BUILDAH_ISOLATION=%s _CONTAINERS_USERNS_CONFIGURED=%s CONTAINERS_STORAGE_CONF=%s CONTAINERS_CONF=%s\n' \
-  "${BUILDAH_ISOLATION:-}" "${_CONTAINERS_USERNS_CONFIGURED:-}" "${CONTAINERS_STORAGE_CONF:-}" "${CONTAINERS_CONF:-}" >>"$TEST_TOOL_LOG"
-printf 'podman %s\n' "$*" >>"$TEST_TOOL_LOG"
-exit 0
-EOF
   cat >"$helper_bin/apt-get" <<'EOF'
 #!/usr/bin/env bash
 set -euo pipefail
@@ -1106,190 +1058,36 @@ while [[ $# -gt 0 ]]; do
 done
 exec "$@"
 EOF
-  chmod +x "$helper_bin/podman" "$helper_bin/apt-get" "$helper_bin/tcpdump" "$helper_bin/setpriv"
+  chmod +x "$helper_bin/apt-get" "$helper_bin/tcpdump" "$helper_bin/setpriv"
 
   if ! grep -q "chmod 711 \"\\\$helper_dir\"" "$helper_bin/sloptrap-entrypoint" \
     || ! grep -q "chmod 1733 \"\\\$queue_dir\"" "$helper_bin/sloptrap-entrypoint"; then
     record_failure "embedded_capability_helpers: entrypoint did not expose helper queue to the dropped user"
   fi
 
-  local autostart_helper_dir
-  autostart_helper_dir="$temp_root/helper-autostart"
-  if ! TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_HELPER_DIR="$autostart_helper_dir" \
+  if grep -q -- "setpriv --reuid 0 --regid 0" "$helper_bin/slop-apt" \
+    || grep -q -- "setpriv --reuid 0 --regid 0" "$helper_bin/slopcap"; then
+    record_failure "embedded_capability_helpers: helper clients should not attempt to regain root"
+  fi
+  if TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_HELPER_DIR="$temp_root/helper-missing" \
     SLOPTRAP_ACTIVE_CAPABILITIES="apt-install packet-capture" \
     SLOPTRAP_CAPTURE_DIR="$capture_dir" SLOPTRAP_WORKDIR="$workspace_dir" \
-    SLOPTRAP_AUDIT_LOG="$temp_root/autostart-audit.log" \
-    SLOPTRAP_HOST_UID="$(id -u)" SLOPTRAP_HOST_GID="$(id -g)" \
-    "$helper_bin/slop-apt" install jq >/dev/null 2>&1; then
-    record_failure "embedded_capability_helpers: slop-apt did not self-bootstrap the helper daemon"
-  fi
-  if [[ ! -r $autostart_helper_dir/helperd.pid ]]; then
-    record_failure "embedded_capability_helpers: helper self-bootstrap did not create a pid file"
-  else
-    kill "$(cat "$autostart_helper_dir/helperd.pid")" >/dev/null 2>&1 || true
-    wait "$(cat "$autostart_helper_dir/helperd.pid")" >/dev/null 2>&1 || true
-  fi
-
-  local missing_cap_status=0
-  if TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_ACTIVE_CAPABILITIES="" \
-    SLOPTRAP_WORKDIR="$workspace_dir" \
-    SLOPTRAP_INNER_PODMAN_ROOT="$inner_podman_root" \
-    SLOPTRAP_INNER_PODMAN_RUNROOT="$inner_podman_runroot" \
-    XDG_RUNTIME_DIR="$inner_runtime_dir" \
-    "$helper_bin/sloppodman" ps >/dev/null 2>&1; then
-    record_failure "embedded_capability_helpers: sloppodman should reject runs without nested-podman"
-  else
-    missing_cap_status=$?
-  fi
-  if [[ $missing_cap_status -ne 126 ]]; then
-    record_failure "embedded_capability_helpers: sloppodman returned the wrong status when capability was absent"
-  fi
-
-  if TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_ACTIVE_CAPABILITIES="nested-podman" \
-    SLOPTRAP_WORKDIR="$workspace_dir" \
-    SLOPTRAP_INNER_PODMAN_ROOT="$inner_podman_root" \
-    SLOPTRAP_INNER_PODMAN_RUNROOT="$inner_podman_runroot" \
-    XDG_RUNTIME_DIR="$inner_runtime_dir" \
-    "$helper_bin/sloppodman" run --privileged example/image >/dev/null 2>&1; then
-    record_failure "embedded_capability_helpers: sloppodman allowed --privileged"
-  fi
-
-  if TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_ACTIVE_CAPABILITIES="nested-podman" \
-    SLOPTRAP_WORKDIR="$workspace_dir" \
-    SLOPTRAP_INNER_PODMAN_ROOT="$inner_podman_root" \
-    SLOPTRAP_INNER_PODMAN_RUNROOT="$inner_podman_runroot" \
-    XDG_RUNTIME_DIR="$inner_runtime_dir" \
-    "$helper_bin/sloppodman" run -v /tmp:/host example/image >/dev/null 2>&1; then
-    record_failure "embedded_capability_helpers: sloppodman allowed an out-of-workspace bind mount"
-  fi
-
-  if ! (
-    cd "$workspace_dir" && TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" \
-      SLOPTRAP_ACTIVE_CAPABILITIES="nested-podman" SLOPTRAP_WORKDIR="$workspace_dir" \
-      SLOPTRAP_INNER_PODMAN_ROOT="$inner_podman_root" \
-      SLOPTRAP_INNER_PODMAN_RUNROOT="$inner_podman_runroot" \
-      XDG_RUNTIME_DIR="$inner_runtime_dir" \
-      "$helper_bin/sloppodman" run -v ./data:/data example/image true >/dev/null 2>&1
-  ); then
-    record_failure "embedded_capability_helpers: sloppodman rejected a workspace-local bind mount"
-  fi
-  if ! grep -q -- 'podman --root ' "$tool_log" || ! grep -q -- '-v ./data:/data' "$tool_log"; then
-    record_failure "embedded_capability_helpers: sloppodman did not invoke podman with the validated run arguments"
-  fi
-  if ! grep -q -- 'setpriv --reuid 0 --regid 0 --clear-groups -- env ' "$tool_log"; then
-    record_failure "embedded_capability_helpers: sloppodman did not re-enter root before invoking podman"
-  fi
-  if ! TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_ACTIVE_CAPABILITIES="nested-podman" \
-    SLOPTRAP_WORKDIR="$workspace_dir" \
-    SLOPTRAP_INNER_PODMAN_ROOT="$inner_podman_root" \
-    SLOPTRAP_INNER_PODMAN_RUNROOT="$inner_podman_runroot" \
-    XDG_RUNTIME_DIR="$inner_runtime_dir" \
-    "$helper_bin/sloppodman" image inspect example/image >/dev/null 2>&1; then
-    record_failure "embedded_capability_helpers: sloppodman rejected image inspect"
-  fi
-  if ! grep -q -- 'podman --root .* image inspect example/image' "$tool_log"; then
-    record_failure "embedded_capability_helpers: sloppodman did not forward image inspect"
-  fi
-  if ! grep -q -- '--storage-driver vfs' "$tool_log" \
-    || ! grep -q -- '--cgroup-manager cgroupfs' "$tool_log" \
-    || ! grep -q -- '--events-backend file' "$tool_log"; then
-    record_failure "embedded_capability_helpers: sloppodman did not apply the nested podman runtime defaults"
-  fi
-  if ! grep -q -- 'podman-env BUILDAH_ISOLATION=chroot ' "$tool_log"; then
-    record_failure "embedded_capability_helpers: sloppodman did not set BUILDAH_ISOLATION=chroot"
-  fi
-  if ! grep -q -- '_CONTAINERS_USERNS_CONFIGURED=done ' "$tool_log"; then
-    record_failure "embedded_capability_helpers: sloppodman did not mark nested podman as already userns-configured"
-  fi
-  if [[ ! -f $inner_runtime_dir/config/containers/storage.conf ]] \
-    || [[ ! -f $inner_runtime_dir/config/containers/containers.conf ]]; then
-    record_failure "embedded_capability_helpers: sloppodman did not materialize its container config files"
-  elif ! grep -q -- 'ignore_chown_errors = "true"' "$inner_runtime_dir/config/containers/storage.conf"; then
-    record_failure "embedded_capability_helpers: storage.conf did not enable ignore_chown_errors"
-  fi
-
-  local caller_uid caller_gid caller_user
-  caller_uid=$(id -u)
-  caller_gid=$(id -g)
-  caller_user=$(id -un)
-  cat >"$helper_bin/id" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-case "${1-}" in
-  -u)
-    printf '0\n'
-    ;;
-  -g)
-    printf '0\n'
-    ;;
-  -un)
-    printf 'root\n'
-    ;;
-  *)
-    printf 'uid=0(root) gid=0(root) groups=0(root)\n'
-    ;;
-esac
-EOF
-  cat >"$temp_root/entrypoint-helperd" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-exit 0
-EOF
-  chmod +x "$helper_bin/id" "$temp_root/entrypoint-helperd"
-  local entry_subuid entry_subgid
-  entry_subuid="$temp_root/entry-subuid"
-  entry_subgid="$temp_root/entry-subgid"
-  printf 'sloptrap:100000:65536\n' >"$entry_subuid"
-  printf 'sloptrap:100000:65536\n' >"$entry_subgid"
-  if ! TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_ACTIVE_CAPABILITIES="nested-podman" \
-    SLOPTRAP_HOST_UID="1337" SLOPTRAP_HOST_GID="1337" SLOPTRAP_HOST_USER="$caller_user" \
-    SLOPTRAP_PODMAN_SUBUID_FILE="$entry_subuid" SLOPTRAP_PODMAN_SUBGID_FILE="$entry_subgid" \
-    SLOPTRAP_PODMAN_SUBID_START="200000" SLOPTRAP_PODMAN_SUBID_COUNT="65536" \
-    SLOPTRAP_PODMAN_SUBGID_START="200000" SLOPTRAP_PODMAN_SUBGID_COUNT="65536" \
-    SLOPTRAP_HELPERD_BIN="$temp_root/entrypoint-helperd" \
-    "$helper_bin/sloptrap-entrypoint" true >/dev/null 2>&1; then
-    record_failure "embedded_capability_helpers: entrypoint did not synthesize subid files for the host user"
-  fi
-  if [[ -z $(awk -F: -v account="$caller_user" '$1 == account { print $2 ":" $3 }' "$entry_subuid" 2>/dev/null || true) ]]; then
-    record_failure "embedded_capability_helpers: entrypoint did not prefer SLOPTRAP_HOST_USER for subuid synthesis"
-  fi
-  if [[ -z $(awk -F: -v account="$caller_user" '$1 == account { print $2 ":" $3 }' "$entry_subgid" 2>/dev/null || true) ]]; then
-    record_failure "embedded_capability_helpers: entrypoint did not prefer SLOPTRAP_HOST_USER for subgid synthesis"
-  fi
-  local caller_subuid root_subuid caller_subgid root_subgid
-  local helper_subuid_file helper_subgid_file
-  helper_subuid_file="$temp_root/helper-subuid"
-  helper_subgid_file="$temp_root/helper-subgid"
-  if ! TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_ACTIVE_CAPABILITIES="nested-podman" \
-    SLOPTRAP_WORKDIR="$workspace_dir" \
-    SLOPTRAP_INNER_PODMAN_ROOT="$inner_podman_root" \
-    SLOPTRAP_INNER_PODMAN_RUNROOT="$inner_podman_runroot" \
-    XDG_RUNTIME_DIR="$inner_runtime_dir" \
-    SLOPTRAP_PODMAN_ESCALATED=1 \
-    SLOPTRAP_PODMAN_CALLER_UID="$caller_uid" \
-    SLOPTRAP_PODMAN_CALLER_GID="$caller_gid" \
-    SLOPTRAP_PODMAN_CALLER_USER="$caller_user" \
-    SLOPTRAP_PODMAN_SUBUID_FILE="$helper_subuid_file" \
-    SLOPTRAP_PODMAN_SUBGID_FILE="$helper_subgid_file" \
-    "$helper_bin/sloppodman" image inspect example/image >/dev/null 2>&1; then
-    record_failure "embedded_capability_helpers: sloppodman did not synthesize caller and root subid files"
-  fi
-  caller_subuid=$(awk -F: -v account="$caller_user" '$1 == account { print $2 ":" $3 }' "$helper_subuid_file" 2>/dev/null || true)
-  root_subuid=$(awk -F: '$1 == "root" { print $2 ":" $3 }' "$helper_subuid_file" 2>/dev/null || true)
-  caller_subgid=$(awk -F: -v account="$caller_user" '$1 == account { print $2 ":" $3 }' "$helper_subgid_file" 2>/dev/null || true)
-  root_subgid=$(awk -F: '$1 == "root" { print $2 ":" $3 }' "$helper_subgid_file" 2>/dev/null || true)
-  if [[ -z $caller_subuid || $caller_subuid != "$root_subuid" ]]; then
-    record_failure "embedded_capability_helpers: sloppodman did not mirror caller subuid data onto root"
-  fi
-  if [[ -z $caller_subgid || $caller_subgid != "$root_subgid" ]]; then
-    record_failure "embedded_capability_helpers: sloppodman did not mirror caller subgid data onto root"
+    "$helper_bin/slop-apt" install jq >"$temp_root/missing-helper.out" 2>"$temp_root/missing-helper.err"; then
+    record_failure "embedded_capability_helpers: slop-apt should fail when the root helper is unavailable"
+  elif ! grep -q -- 'capability helper is unavailable' "$temp_root/missing-helper.err"; then
+    record_failure "embedded_capability_helpers: missing helper failure should explain the boundary"
   fi
 
   TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_HELPER_DIR="$helper_dir" \
     SLOPTRAP_ACTIVE_CAPABILITIES="apt-install packet-capture" \
+    SLOPTRAP_APT_GET_BIN="$helper_bin/apt-get" \
+    SLOPTRAP_TCPDUMP_BIN="$helper_bin/tcpdump" \
     SLOPTRAP_CAPTURE_DIR="$capture_dir" SLOPTRAP_WORKDIR="$workspace_dir" \
     SLOPTRAP_AUDIT_LOG="$temp_root/audit.log" "$helper_bin/sloptrap-helperd" >/dev/null 2>&1 &
   helper_pid=$!
+  if ! wait_for_path "$helper_dir/helperd.pid"; then
+    record_failure "embedded_capability_helpers: helper daemon did not publish its pid file"
+  fi
 
   if ! TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_HELPER_DIR="$helper_dir" \
     "$helper_bin/slop-apt" install jq >/dev/null 2>&1; then
@@ -1314,17 +1112,19 @@ EOF
 
   if TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_HELPER_DIR="$helper_dir" \
     SLOPTRAP_CAPTURE_DIR="$capture_dir" SLOPTRAP_WORKDIR="$workspace_dir" \
+    SLOPTRAP_CAPTURE_HELPER_DIR="$helper_dir" SLOPTRAP_PACKET_CAPTURE_ENABLED=1 \
     "$helper_bin/slopcap" capture --interface eth0 --output /tmp/escape.pcap >/dev/null 2>&1; then
     record_failure "embedded_capability_helpers: slopcap accepted an out-of-bounds output path"
   fi
 
   if ! TEST_TOOL_LOG="$tool_log" PATH="$helper_bin:$PATH" SLOPTRAP_HELPER_DIR="$helper_dir" \
     SLOPTRAP_CAPTURE_DIR="$capture_dir" SLOPTRAP_WORKDIR="$workspace_dir" \
+    SLOPTRAP_CAPTURE_HELPER_DIR="$helper_dir" SLOPTRAP_PACKET_CAPTURE_ENABLED=1 \
     "$helper_bin/slopcap" capture --interface eth0 --filter 'tcp port 80' \
     --output "$workspace_dir/capture.pcap" >/dev/null 2>&1; then
     record_failure "embedded_capability_helpers: slopcap failed for a workspace-local capture file"
   fi
-  if ! grep -q -- "tcpdump -i eth0 -w $workspace_dir/capture.pcap -- tcp port 80" "$tool_log"; then
+  if ! grep -q -- "tcpdump -p -i eth0 -w $workspace_dir/capture.pcap -- tcp port 80" "$tool_log"; then
     record_failure "embedded_capability_helpers: slopcap did not invoke tcpdump with the expected guarded arguments"
   fi
 
@@ -1373,7 +1173,7 @@ run_make_install_single_file() {
     record_failure "make_install_single_file: installed launcher missing"
   fi
   local helper
-  for helper in sloptrap-entrypoint sloptrap-helperd slop-apt slopcap sloppodman; do
+  for helper in sloptrap-entrypoint sloptrap-helperd slop-apt slopcap; do
     if [[ -e $install_dir/$helper ]]; then
       record_failure "make_install_single_file: unexpected helper installed ($helper)"
     fi
@@ -1409,8 +1209,6 @@ run_sh_reexec
 run_resume_omits_runtime_context
 run_auth_file_mount
 run_codex_home_override
-run_recursive_slopsloptrap
-run_recursive_parent_image_fallback
 run_project_state_isolation
 run_auto_login_empty_auth
 run_codex_symlink_home
@@ -1424,10 +1222,14 @@ run_invalid_manifest_sandbox
 run_invalid_manifest_packages
 run_invalid_manifest_capabilities
 run_invalid_allow_host_network
+run_host_network_packet_capture_ack_required
+run_host_network_packet_capture_ack_prompt
+run_removed_nested_podman_manifest
 run_wizard_create_manifest
 run_wizard_existing_defaults
 run_wizard_build_trigger
 run_capability_trust_required
+run_capabilities_require_podman
 run_capability_profiles
 run_embedded_capability_helpers
 run_make_install_single_file

tests/wizard_existing/.sloptrap

@@ -1,4 +1,4 @@
 name=custom-wizard
 packages_extra=make git
-capabilities=apt-install packet-capture
+capabilities=apt-install
 allow_host_network=true