e7112db3d7
- remove codex auth mounts from opencode run/shell paths - reject opencode login and invalid backend values - harden opencode config writes against symlink clobbering - fix opencode build args and packages_extra handling - enforce cap-drop and read-only rootfs in runtime commands - reject dangerous runtime/build env overrides - update README and test docs to match actual behavior - extend regression coverage for backend safety and hardening
1.6 KiB
1.6 KiB
Test Scenarios
This directory contains cases that stress sloptrap's hardening and deployment flow. Each subdirectory mimics a user repository and focuses on a single class of behaviour. Use run_tests.sh to execute the automated checks with stubbed tooling.
Current scenarios:
mount_injection/— exercises.sloptrapignoreentries with,and=to ensure mount escape characters remain escaped and forcesbuild_if_missingto execute the Codex download/build path.root_target/— ensures attempts to mask the project root are rejected.symlink_escape/— confirms symlink targets resolving outside the project are blocked.manifest_injection/— ensures disallowedmake.*overrides abort parsing.helper_symlink/— ensures.sloptrap-ignorescannot be a symlink to directories outside the project.secret_mask/— verifies masked files remain hidden even when sloptrap remaps the workspace mount.resume_target/— verifies the resume target passes the requested session identifier to Codex.auth_file_mount— verifies~/.codex/auth.jsonis mounted directly into/codex/auth.json.runtime_hardening_flags— verifies standard runs add--cap-drop=ALLand keep the root filesystem read-only.project_state_isolation— verifies different projects map/codexto different host state directories.auto_login_empty_auth— verifies an emptyauth.jsonstill triggers automatic login before the main target.opencode_*— exercises opencode build/download, localhost rewriting, config generation, and backend-specific safety checks.