Ë
    ÛJêj­e  ã                  ó  — d Z ddlmZ ddlZddlmc mZ ddl	Z	ddl
Z
ddlZddlZddlmZ ddlZddlmZmZmZ ddlmZmZ ddlmZmZmZ ddlmZ dd	lmZmZm Z  dd
l!m"Z"m#Z#m$Z$ ddl%m&Z&m'Z' ddl(m)Z) ejT                  jW                   ejX                  d«      du d¬«      Z-ej\                  d.d„«       Z/ejT                  j                  e-d/d„«       «       Z0ejT                  j                  e-d/d„«       «       Z1ejT                  j                  e-d/d„«       «       Z2ejT                  j                  e-d/d„«       «       Z3ejT                  j                  e-d/d„«       «       Z4ejT                  j                  e-	 	 	 	 d0d„«       «       Z5ejT                  j                  	 	 	 	 	 	 	 	 d1d„«       Z6ejT                  j                  	 	 	 	 	 	 d2d„«       Z7ejT                  j                  	 	 	 	 	 	 	 	 d1d„«       Z8ejT                  j                  	 	 	 	 	 	 	 	 	 	 d3d„«       Z9ejT                  j                  	 	 	 	 	 	 d2d„«       Z:ejT                  j                  	 	 	 	 	 	 	 	 	 	 d3d„«       Z;ejT                  j                  e-	 	 	 	 	 	 d4d„«       «       Z<ejT                  j                  e-	 	 	 	 	 	 	 	 d5d„«       «       Z=	 	 	 	 	 	 d6d„Z>ejT                  j                  e-d/d „«       «       Z?ejT                  j                  d/d!„«       Z@ejT                  j                  d7d"„«       ZAejT                  j                  e-d/d#„«       «       ZBejT                  j                  d/d$„«       ZC G d%„ d&«      ZDdd'œ	 	 	 	 	 	 	 	 	 	 	 	 	 d8d(„ZEejT                  j                  d/d)„«       ZFejT                  j                  d/d*„«       ZGejT                  j                  d/d+„«       ZHejT                  j                  d/d,„«       ZIejT                  j                  d/d-„«       ZJy)9z5Tests for the Bubblewrap isolated execution provider.é    )ÚannotationsN)ÚPath)ÚAuthorizedExecutionServiceÚBubblewrapExecutionProviderÚExecutionRefused)Úensure_workspaces_rootÚis_within_workspaces_root)ÚExecutionAuthorizationÚbound_execution_authorizationÚexecution_payload_digest)ÚApprovalManager)ÚAuditEventTypeÚAuditLogÚ
AuditQuery)ÚAgentIdentityÚPermissionScopeÚ
TrustLevel)ÚPermissionGatewayÚSecurityError)ÚPolicyEngineÚbwrapzBubblewrap is unavailable)Úreasonc                óF   ‡— g Šdˆfd„}| j                  t        d|«       ‰S )zÄFail the test if any subprocess is created.

    The confinement check has to happen before Bubblewrap exists, so a refused
    workspace is asserted by proving that nothing was ever spawned.
    c               Ÿ  óD   •K  — ‰j                  | «       t        d«      ‚­w)Nz;a process was spawned even though the workspace was refused)ÚappendÚAssertionError)ÚargsÚkwargsÚattemptss     €ú?/home/oem/CyberBrain26-unified/tests/test_execution_provider.pyÚ_recordz"no_process_launch.<locals>._record,   s   øè ø€ Ø�‰˜ÔÜÐZÓ[Ð[ùs   ƒ Úcreate_subprocess_exec)r   Úobjectr   r#   ÚreturnÚNone)ÚsetattrÚasyncio)Úmonkeypatchr!   r   s     @r    Úno_process_launchr)   #   s*   ø€ ð *,€Hõ\ð ×ÑœÐ!9¸7ÔCØ€Oó    c               ƒ  óÖ  K  — t        «       } | j                  dd«      ƒ d {  –—† }|d   }d}||k(  }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd	|iz  }t        t        j                  |«      «      ‚d x}x}}|d
   }|j                  } |«       }d}||k(  }	|	s”t        j                  d|	fd||f«      t        j                  |«      t        j                  |«      t        j                  |«      t        j                  |«      dœz  }
dd|
iz  }t        t        j                  |«      «      ‚d x}x}x}x}	}|d   }d}||k(  }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd	|iz  }t        t        j                  |«      «      ‚d x}x}}|d   }d}||u }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd	|iz  }t        t        j                  |«      «      ‚d x}x}}y 7 �ŒD­w)Nzprint('sandbox-ok')ÚpythonÚreturn_coder   ©ú==©z%(py1)s == %(py4)s©Úpy1Úpy4úassert %(py6)sÚpy6Ústdoutz
sandbox-ok©zD%(py5)s
{%(py5)s = %(py3)s
{%(py3)s = %(py1)s.strip
}()
} == %(py8)s©r2   Úpy3Úpy5Úpy8úassert %(py10)sÚpy10ÚproviderÚ
bubblewrapÚ	timed_outF©Úis©z%(py1)s is %(py4)s©r   ÚexecuteÚ
@pytest_arÚ_call_reprcompareÚ	_safereprr   Ú_format_explanationÚstrip©r>   ÚresultÚ@py_assert0Ú@py_assert3Ú@py_assert2Ú@py_format5Ú@py_format7Ú@py_assert4Ú@py_assert7Ú@py_assert6Ú@py_format9Ú@py_format11s               r    Ú*test_python_executes_in_isolated_workspacerW   4   s¡  è ø€ ô +Ó,€HØ×#Ñ#Ð$9¸8ÓD×D€Fà�-Ñ Ð% AÐ%Ð  AÑ%×%×%Õ%Ð  A×%×%Ó%Ð ×%×%Ò% A×%×%×%×%×%×%Ó%Ø�(ÑÐ3Ð×!Ñ!Ð3Ñ!Ó#Ð3 |Ð3Ð# |Ñ3×3×3Õ3Ð# |×3×3Ó3Ð×3×3Ò3Ð!×3×3Ò3Ð#×3×3Ò3 |×3×3×3×3×3×3×3Ø�*ÑÐ- Ð-Ð Ñ-×-×-Õ-Ð ×-×-Ó-Ð×-×-Ò- ×-×-×-×-×-×-Ó-Ø�+ÑÐ' %Ð'Ð %Ð'×'×'Õ'Ð %×'×'Ó'Ð×'×'Ò' %×'×'×'×'×'×'Ô'ð Eûs   ‚ I)¢I&£II)c               ƒ  óØ  K  — t        «       } | j                  dd«      ƒ d {  –—† }|d   }d}||k(  }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd	|iz  }t        t        j                  |«      «      ‚d x}x}}|d
   }|j                  } |«       }d}||k(  }	|	s”t        j                  d|	fd||f«      t        j                  |«      t        j                  |«      t        j                  |«      t        j                  |«      dœz  }
dd|
iz  }t        t        j                  |«      «      ‚d x}x}x}x}	}y 7 �ŒE­w)Nz@import socket
print([name for _, name in socket.if_nameindex()])r,   r-   r   r.   r0   r1   r4   r5   r6   z['lo']r7   r8   r<   r=   rD   rK   s               r    Ú.test_sandbox_has_no_external_network_interfacerY   @   s  è ø€ ô +Ó,€HØ×#Ñ#ØKØó÷ €Fð
 �-Ñ Ð% AÐ%Ð  AÑ%×%×%Õ%Ð  A×%×%Ó%Ð ×%×%Ò% A×%×%×%×%×%×%Ó%Ø�(ÑÐ/Ð×!Ñ!Ð/Ñ!Ó#Ð/ xÐ/Ð# xÑ/×/×/Õ/Ð# x×/×/Ó/Ð×/×/Ò/Ð!×/×/Ò/Ð#×/×/Ò/ x×/×/×/×/×/×/×/Ð/ðûó   ‚ E*¢E'£EE*c               ƒ  ó
  K  — t        «       } | j                  ddd¬«      ƒ d{  –—† }|d   }d}||k(  }|s…t        j                  d|fd	||f«      t        j                  |«      t        j                  |«      d
œz  }t        j
                  |d   «      dz   d|iz  }t        t        j                  |«      «      ‚dx}x}}|d   }|j                  }d} ||«      }| }	|	sŠt        j
                  d«      dz   t        j                  |«      t        j                  |«      t        j                  |«      t        j                  |«      dœz  }
t        t        j                  |
«      «      ‚dx}x}x}x}}	d}|d   }||v }|s…t        j                  d|fd||f«      t        j                  |«      t        j                  |«      d
œz  }t        j
                  |d   «      dz   d|iz  }t        t        j                  |«      «      ‚dx}x}}t        |d   j                  d«      d   j                  «       d   «      }d}||k  }|s³t        j                  d|fd||f«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dœz  }t        j
                  d|› d�«      dz   d |iz  }t        t        j                  |«      «      ‚dx}}y7 �ŒÜ­w)!a/  Sharing the network must not share PID, IPC or the user namespace.

    An argv assertion cannot catch this: ``--share-net`` on its own is a
    perfectly well-formed vector that bwrap accepts, and it silently drops
    *every* unshare directive because bwrap unshares nothing by default. Run
    with the flag, the sandbox reported ``/proc/1/comm == "systemd"`` - the host
    init - and could list 327 host processes and read ``/proc/<pid>/environ`` of
    a host process, i.e. every API key and token of this user. Only executing
    bwrap shows that.
    z‹import os
print('pid1=' + open('/proc/1/comm').read().strip())
print('procs=' + str(len([d for d in os.listdir('/proc') if d.isdigit()])))
r,   T©Úallow_networkNr-   r   r.   r0   r1   Ústderrú
>assert %(py6)sr5   r6   zpid1=systemdz*the sandbox adopted the host PID namespacezR
>assert not %(py7)s
{%(py7)s = %(py3)s
{%(py3)s = %(py1)s.startswith
}(%(py5)s)
})r2   r9   r:   Úpy7z
pid1=bwrap©Úin©z%(py1)s in %(py4)szprocs=é   é2   )ú<)z%(py0)s < %(py3)sÚvisible©Úpy0r9   zsandbox sees z$ processes - PID namespace is sharedz
>assert %(py5)sr:   )r   rE   rF   rG   rH   Ú_format_assertmsgr   rI   Ú
startswithÚintÚsplitÚ
splitlinesÚ@py_builtinsÚlocalsÚ_should_repr_global_name)r>   rL   rM   rN   rO   rP   rQ   rR   rT   Ú@py_assert8rU   rg   Ú@py_assert1Ú@py_format4Ú@py_format6s                  r    Ú4test_the_network_profile_keeps_its_own_pid_namespacerv   M   sW  è ø€ ô +Ó,€HØ×#Ñ#ð	Xð 	Øð $ó ÷ €Fð �-Ñ Ð7 AÐ7Ð  AÑ%×7×7Õ7Ð  A×7×7Ó7Ð ×7×7Ò7 A×7×7×7 v¨hÑ'7×7×7×7×7×7×7Ð7Ø�hÑð Ð×*Ñ*ð ¨>ð Ñ*¨>Ó:ð Ð:Ð:ð Ñ:ô ïé ð 	5÷ó ïé ð  ÷ ð ïé ð +÷ ð ïé ð ,:÷ ð ïé ð ;÷ ÷ ò ïé ÷÷ ó ð Ð=˜6 (Ñ+Ð=ˆ<Ð+Ð+×=×=Õ=ˆ<Ð+×=×=Ó=ˆ<×=×=Ò=Ð+×=×=×=¨V°HÑ-=×=×=×=×=×=×=Ð=ô �&˜Ñ"×(Ñ(¨Ó2°1Ñ5×@Ñ@ÓBÀ1ÑEÓF€GØÐVˆ7�R‰<×V×VÕVˆ7�R×V×V×V×V×VÑVˆ7×V×VÓVˆ7×V×VÔV�R×V×V×V˜=¨¨	Ð1UÐV×V×V×V×V×V×Vð!ûs   ‚"L¤L ¥KLc               ƒ  óL  K  — t        «       } | j                  ddd¬«      ƒ d{  –—† }|d   }d}||k(  }|s…t        j                  d|fd	||f«      t        j                  |«      t        j                  |«      d
œz  }t        j
                  |d   «      dz   d|iz  }t        t        j                  |«      «      ‚dx}x}}|d   j                  d«      d   j                  «       j                  d«      }t        |«      }d}||kD  }	|	�st        j                  d|	fd||f«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      nddt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      t        j                  |«      dœz  }t        j
                  d|› �«      dz   d|iz  }
t        t        j                  |
«      «      ‚dx}x}	}y7 �Œý­w)zäThe counterpart to the test above: the grant must actually work.

    Without this, "keep ``--unshare-all``" is satisfied by a sandbox that has no
    network at all - a silent refusal that would read as a pentest tool bug.
    z_import socket
names = [n for _, n in socket.if_nameindex()]
print('ifaces=' + ','.join(names))
r,   Tr\   Nr-   r   r.   r0   r1   r^   r_   r5   r6   zifaces=rd   ú,)ú>)z/%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} > %(py6)sÚlenÚifaces©ri   r2   r9   r5   z%network profile still has no egress: z
>assert %(py8)sr;   )r   rE   rF   rG   rH   rj   r   rI   rm   rJ   rz   ro   rp   rq   )r>   rL   rM   rN   rO   rP   rQ   r{   Ú@py_assert5rR   rU   s              r    Ú6test_the_network_profile_really_does_reach_the_networkr~   n   sl  è ø€ ô +Ó,€HØ×#Ñ#ð	/ð 	Øð $ó ÷ €Fð �-Ñ Ð7 AÐ7Ð  AÑ%×7×7Õ7Ð  A×7×7Ó7Ð ×7×7Ò7 A×7×7×7 v¨hÑ'7×7×7×7×7×7×7Ð7Ø�HÑ×#Ñ# IÓ.¨qÑ1×7Ñ7Ó9×?Ñ?ÀÓD€FÜˆv‹;ÐL˜ÐLˆ;˜‰?×L×LÖLˆ;˜×L×L×L×L×LÑLŒ3×L×LÓLŒ3×L×L×L×L×LÒLˆv×L×LÓLˆv×L×LÔLˆ;×L×LÒL˜×L×L×LÐCÀFÀ8ÐL×L×L×L×L×L×LÑLðûs   ‚"H$¤H!¥G=H$c               ƒ  óØ  K  — t        «       } | j                  dd«      ƒ d {  –—† }|d   }d}||k(  }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd	|iz  }t        t        j                  |«      «      ‚d x}x}}|d
   }|j                  } |«       }d}||k(  }	|	s”t        j                  d|	fd||f«      t        j                  |«      t        j                  |«      t        j                  |«      t        j                  |«      dœz  }
dd|
iz  }t        t        j                  |«      «      ‚d x}x}x}x}	}y 7 �ŒE­w)Nzprintf 'shell-ok\n'Úshellr-   r   r.   r0   r1   r4   r5   r6   zshell-okr7   r8   r<   r=   rD   rK   s               r    Ú&test_shell_executes_inside_the_sandboxr�   „   s   è ø€ ô +Ó,€HØ×#Ñ#Ð$:¸GÓD×D€Fà�-Ñ Ð% AÐ%Ð  AÑ%×%×%Õ%Ð  A×%×%Ó%Ð ×%×%Ò% A×%×%×%×%×%×%Ó%Ø�(ÑÐ1Ð×!Ñ!Ð1Ñ!Ó#Ð1 zÐ1Ð# zÑ1×1×1Õ1Ð# z×1×1Ó1Ð×1×1Ò1Ð!×1×1Ò1Ð#×1×1Ò1 z×1×1×1×1×1×1×1Ð1ð EûrZ   c           	   ƒ  ó°  K  — t        «       }| dz  }|j                  «        | j                  dz  }|j                  dd¬«       |j	                  dt        |«      ›d�dt        |«      ¬	«      ƒ d {  –—† }|d
   }d}||k(  }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd|iz  }	t        t        j                  |	«      «      ‚d x}x}}|d   }|j                  } |«       }
d}|
|k(  }|s”t        j                  d|fd|
|f«      t        j                  |«      t        j                  |«      t        j                  |
«      t        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}x}x}
x}}d}||z  }|j                  }
d} |
|¬«      }d}||k(  }|sét        j                  d|fd||f«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      t        j                  |
«      t        j                  |«      t        j                  |«      t        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}x}x}
x}x}x}}|j                  }d} ||¬«      }d}||k(  }|sÕt        j                  d|fd||f«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      t        j                  |«      t        j                  |«      t        j                  |«      dœz  }d d!|iz  }t        t        j                  |«      «      ‚d x}x}x}x}}y 7 �Œb­w)"NÚ	workspacezoutside-secret.txtzhost-secretúutf-8©ÚencodingzMfrom pathlib import Path
Path('created.txt').write_text('inside')
print(Path(z).exists())
r,   ©rƒ   r-   r   r.   r0   r1   r4   r5   r6   ÚFalser7   r8   r<   r=   zcreated.txtÚinside©ze%(py9)s
{%(py9)s = %(py5)s
{%(py5)s = (%(py0)s / %(py2)s).read_text
}(encoding=%(py7)s)
} == %(py12)s©ri   Úpy2r:   r`   Úpy9Úpy12úassert %(py14)sÚpy14)zX%(py6)s
{%(py6)s = %(py2)s
{%(py2)s = %(py0)s.read_text
}(encoding=%(py4)s)
} == %(py9)sÚsecret)ri   rŒ   r3   r5   r�   zassert %(py11)sÚpy11)r   ÚmkdirÚparentÚ
write_textrE   ÚstrrF   rG   rH   r   rI   rJ   Ú	read_textro   rp   rq   )Úsandbox_workspaces_rootr>   rƒ   r‘   rL   rM   rN   rO   rP   rQ   rR   rS   rT   rU   rV   rs   rr   Ú@py_assert11Ú@py_assert10Ú@py_format13Ú@py_format15r}   Ú@py_format10Ú@py_format12s                           r    Ú;test_workspace_is_writable_but_neighboring_files_are_hiddenrŸ   Ž   s°  è ø€ ô
 +Ó,€HØ'¨+Ñ5€IØ‡O�OÔð %×+Ñ+Ð.BÑB€FØ
×Ñ�m¨gÐÔ6Ø×#Ñ#ð	ä˜&“k�_ Mð	3ð 	Ü�i“.ð $ó ÷ €Fð �-Ñ Ð% AÐ%Ð  AÑ%×%×%Õ%Ð  A×%×%Ó%Ð ×%×%Ò% A×%×%×%×%×%×%Ó%Ø�(ÑÐ.Ð×!Ñ!Ð.Ñ!Ó#Ð. wÐ.Ð# wÑ.×.×.Õ.Ð# w×.×.Ó.Ð×.×.Ò.Ð!×.×.Ò.Ð#×.×.Ò. w×.×.×.×.×.×.×.Ø%ÐNˆI˜Ñ%ÐNÐ%×0Ñ0ÐN¸'ÐNÑ0¸'ÔBÐNÀhÐNÐBÀhÑN×N×NÕNÐBÀh×N×N×N×N×NÑNˆI×N×NÓNˆI×N×NÔN˜×N×NÒNÐ0×N×NÒN¸'×N×NÒNÐB×N×NÒNÀh×N×N×N×N×N×N×NÓNØ×ÑÐ> WÐ>Ñ WÔ-Ð>°Ð>Ð-°Ñ>×>×>Õ>Ð-°×>×>×>×>×>Ñ>ˆ6×>×>Ó>ˆ6×>×>Ô>Ð×>×>Ò> W×>×>Ò>Ð-×>×>Ò>°×>×>×>×>×>×>×>Ð>ðûs   ‚A/OÁ1OÁ2M"Oc              ƒ  óô  K  — t        «       }| dz  }|j                  «        t        j                  t        «      5 }|j                  ddt        |«      ¬«      ƒ d {  –—†  d d d «       t        j                  «      }d}||v }|s™t        j                  d|fd||f«      t        j                  |«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndd	œz  }	d
d|	iz  }
t        t        j                  |
«      «      ‚d x}}t        |«      }||v }|�s9t        j                  d|fd||f«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      nddt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dt        j                  «       v st        j                  |«      rt        j                  |«      nddœz  }
t        j                   d«      dz   d|
iz  }t        t        j                  |«      «      ‚d x}}t        |«      }||v }|�s9t        j                  d|fd||f«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      nddt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dt        j                  «       v st        j                  |«      rt        j                  |«      nddœz  }
t        j                   d«      dz   d|
iz  }t        t        j                  |«      «      ‚d x}}g }||k(  }|s™t        j                  d|fd||f«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dœz  }	d
d|	iz  }
t        t        j                  |
«      «      ‚d x}}y 7 �Œ# 1 sw Y   �ŒxY w­w)NÚoutsideúprint('must not run')r,   r‡   ú#outside the allowed workspaces rootra   )z%(py1)s in %(py3)sÚmessage)r2   r9   úassert %(py5)sr:   )z0%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} in %(py5)sr–   ©ri   r2   r9   r:   z(the refusal must name the offending pathz
>assert %(py7)sr`   r˜   z&the refusal must name the allowed rootr.   ©z%(py0)s == %(py3)sr)   rh   )r   r“   ÚpytestÚraisesÚ
ValueErrorrE   r–   ÚvaluerF   rG   rH   ro   rp   rq   r   rI   rj   )Útmp_pathr˜   r)   r>   r¡   Úexcinfor¤   rM   rO   rt   ru   rR   Ú@py_format8rs   s                 r    Ú2test_workspace_outside_the_allowed_root_is_refusedr¯   ±   s�  è ø€ ô +Ó,€HØ˜Ñ"€GØ‡M�M„Oä	�‰”zÓ	"ð Z gØ×ÑÐ6¸ÌCÐPWËLÐÓY×YÐY÷Zô �'—-‘-Ó €GØ0Ð;Ð0°GÐ;×;×;Õ;Ð0°G×;×;Ó;Ð0×;×;×;×;×;Ð;°G×;×;Ó;°G×;×;×;×;×;×;Ó;Üˆw‹<ÐNˆ<˜7Ð"×N×NÖNˆ<˜7×N×N×N×N×NÑNŒ3×N×NÓNŒ3×N×N×N×N×NÒNˆw×N×NÓNˆw×N×NÔNˆ<×N×N×N×N×NÐN˜7×N×NÓN˜7×N×N×NÑNÐ$N×N×N×N×N×NÖNÜÐ&Ó'Ð\Ð'¨7Ð2×\×\Ö\Ð'¨7×\×\×\×\×\Ñ\Œ3×\×\Ó\Œ3×\×\×\×\×\Ò\Ð&×\×\Ó\Ð&×\×\Ô\Ð'×\×\×\×\×\Ð\¨7×\×\Ó\¨7×\×\×\Ñ\Ð4\×\×\×\×\×\Ö\Ø "Ð"Ð Ñ"×"×"Õ"Ð ×"×"×"×"×"Ñ"Ð×"×"Ó"Ð×"×"Ô" ×"×"×"×"×"×"Ò"ð 	Zù÷Zñ Züs/   ‚9Q8»!Q+ÁQ(ÁQ+Á!PQ8Ñ(Q+Ñ+Q5Ñ0Q8c              ƒ  óp  K  — t        «       }t        j                  t        d¬«      5 }|j	                  ddd¬«      ƒ d {  –—†  d d d «       d}j
                  }t        |«      }||v }|�s
t        j                  d|fd||f«      t        j                  |«      d	t        j                  «       v st        j                  t        «      rt        j                  t        «      nd	d
t        j                  «       v st        j                  |«      rt        j                  |«      nd
t        j                  |«      t        j                  |«      dœz  }dd|iz  }	t        t        j                  |	«      «      ‚d x}x}x}}g }||k(  }
|
s™t        j                  d|
fd||f«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}
}y 7 �Œæ# 1 sw Y   �ŒæxY w­w)Nr£   ©Úmatchr¢   r,   z/etcr‡   ra   ©zK%(py1)s in %(py8)s
{%(py8)s = %(py3)s(%(py6)s
{%(py6)s = %(py4)s.value
})
}r–   r­   ©r2   r9   r3   r5   r;   r<   r=   r.   r§   r)   rh   r¥   r:   )r   r¨   r©   rª   rE   r«   r–   rF   rG   rH   ro   rp   rq   r   rI   )r˜   r)   r>   r­   rM   r}   rS   rO   rU   rV   rs   rt   ru   s                r    Ú*test_system_directory_workspace_is_refusedrµ   Å   s`  è ø€ ô
 +Ó,€Hä	�‰”zÐ)NÔ	Oð TÐSZØ×ÑÐ6¸ÈFÐÓS×SÐS÷Tð Ð'˜Ÿ™Ð'”S˜Ó'Ð'ˆ6Ð'Ð'×'×'Ö'ˆ6Ð'×'×'Ó'ˆ6×'×'×'×'×'Ð'”S×'×'Ó'”S×'×'×'×'×'Ò'˜×'×'Ó'˜×'×'Ô'˜×'×'Ò'Ð'×'×'×'×'×'×'Õ'Ø "Ð"Ð Ñ"×"×"Õ"Ð ×"×"×"×"×"Ñ"Ð×"×"Ó"Ð×"×"Ô" ×"×"×"×"×"×"Ò"ð 	Tù÷Tñ Tüs/   ‚&H6¨H)Á H&ÁH)ÁG!H6È&H)È)H3È.H6c           
   ƒ  ó^  K  — t        «       }| dz  }|j                  «        |dz  }|j                  |«       t        j                  t
        «      5 }|j                  ddt        |«      ¬«      ƒ d {  –—†  d d d «       t        |«      }j                  }t        |«      }	||	v }
|
�s”t        j                  d|
fd||	f«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      ndd	t        j                  «       v st        j                  |«      rt        j                  |«      nd	t        j                  |«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      ndd
t        j                  «       v st        j                  |«      rt        j                  |«      nd
t        j                  |«      t        j                  |	«      dœz  }dd|iz  }t        t        j                   |«      «      ‚d x}x}
x}}	d}|j                  }t        |«      }||v }|�s
t        j                  d|fd||f«      t        j                  |«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      ndd
t        j                  «       v st        j                  |«      rt        j                  |«      nd
t        j                  |«      t        j                  |«      dœz  }dd|iz  }t        t        j                   |«      «      ‚d x}x}x}}g }||k(  }|s™t        j                  d|fd||f«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dœz  }dd|iz  }t        t        j                   |«      «      ‚d x}}y 7 �Œ«# 1 sw Y   �Œ«xY w­w)NÚescapedzescape-linkr¢   r,   r‡   ra   ©zk%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} in %(py10)s
{%(py10)s = %(py5)s(%(py8)s
{%(py8)s = %(py6)s.value
})
}r–   Útargetr­   ©ri   r2   r9   r:   r5   r;   r=   úassert %(py12)srŽ   r£   r³   r´   r<   r=   r.   r§   r)   rh   r¥   r:   )r   r“   Ú
symlink_tor¨   r©   rª   rE   r–   r«   rF   rG   ro   rp   rq   rH   r   rI   )r¬   r˜   r)   r>   r¹   Úlinkr­   rO   rS   Ú@py_assert9rR   rV   r›   rM   r}   rU   rs   rt   ru   s                      r    Ú5test_symlinked_workspace_escaping_the_root_is_refusedr¿   Ó   ss  è ø€ ô +Ó,€HØ˜	Ñ!€FØ
‡L�L„NØ" ]Ñ2€DØ‡O�O�FÔä	�‰”zÓ	"ð W gØ×ÑÐ6¸ÌCÐPTËIÐÓV×VÐV÷Wô
 ˆv‹;Ð,˜gŸm™mÐ,œ#˜mÓ,Ð,ˆ;Ð,Ð,×,×,Ö,ˆ;Ð,×,×,×,×,×,Ñ,Œ3×,×,Ó,Œ3×,×,×,×,×,Ò,ˆv×,×,Ó,ˆv×,×,Ô,ˆ;×,×,×,×,×,Ð,œ#×,×,Ó,œ#×,×,×,×,×,Ò,˜g×,×,Ó,˜g×,×,Ô,˜m×,×,Ò,Ð,×,×,×,×,×,×,Õ,Ø0ÐF¸¿¹ÐF´C¸Ó4FÐFÐ0Ð4FÐF×F×FÖFÐ0Ð4F×F×FÓFÐ0×F×F×F×F×FÐF´C×F×FÓF´C×F×F×F×F×FÒF¸×F×FÓF¸×F×FÔF¸×F×FÒFÐ4F×F×F×F×F×F×FÕFØ "Ð"Ð Ñ"×"×"Õ"Ð ×"×"×"×"×"Ñ"Ð×"×"Ó"Ð×"×"Ô" ×"×"×"×"×"×"Ò"ð 	Wù÷Wñ Wüs1   ‚AP-Á!P Á2PÁ3P Á7N&P-ÐP Ð P*Ð%P-c           
   ƒ  ó  K  — t        «       }| dz  }|j                  «        |dz  dz  }|j                  d¬«       |j                  |«       t        j                  t
        «      5 }|j                  ddd¬	«      ƒ d {  –—†  d d d «       t        |«      }j                  }	t        |	«      }
||
v }|�s”t        j                  d
|fd||
f«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      nddt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      nddt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |	«      t        j                  |
«      dœz  }dd|iz  }t        t        j                   |«      «      ‚d x}x}x}	}
g }||k(  }|s™t        j                  d|fd||f«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dœz  }dd|iz  }t        t        j                   |«      «      ‚d x}}y 7 �Œy# 1 sw Y   �ŒyxY w­w)Nr¡   ÚaÚbT)Úparentsr¢   r,   z../../../../outsider‡   ra   r¸   r–   r­   rº   r»   rŽ   r.   r§   r)   rh   r¥   r:   )r   r“   Úchdirr¨   r©   rª   rE   r–   r«   rF   rG   ro   rp   rq   rH   r   rI   )r¬   r˜   r(   r)   r>   r¡   Únestedr­   rO   rS   r¾   rR   rV   r›   rs   rt   ru   s                    r    Ú,test_relative_traversal_workspace_is_refusedrÆ   é   sÝ  è ø€ ô +Ó,€HØ˜Ñ"€GØ‡M�M„OØ$ sÑ*¨SÑ0€FØ
‡L�L˜€LÔØ×Ñ�fÔä	�‰”zÓ	"ð c gØ×ÑÐ6¸ÐLaÐÓb×bÐb÷cô ˆw‹<Ð-˜wŸ}™}Ð-œ3˜}Ó-Ð-ˆ<Ð-Ð-×-×-Ö-ˆ<Ð-×-×-×-×-×-Ñ-Œ3×-×-Ó-Œ3×-×-×-×-×-Ò-ˆw×-×-Ó-ˆw×-×-Ô-ˆ<×-×-×-×-×-Ð-œ3×-×-Ó-œ3×-×-×-×-×-Ò-˜w×-×-Ó-˜w×-×-Ô-˜}×-×-Ò-Ð-×-×-×-×-×-×-Õ-Ø "Ð"Ð Ñ"×"×"Õ"Ð ×"×"×"×"×"Ñ"Ð×"×"Ó"Ð×"×"Ô" ×"×"×"×"×"×"Ò"ð 	cù÷cñ cüs1   ‚A$LÁ&K:Á>K7Á?K:ÂI4LË7K:Ë:LË?Lc              ƒ  óà	  K  — t        «       }|j                  }|| k(  }|sÚt        j                  d|fd|| f«      dt	        j
                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dt	        j
                  «       v st        j                  | «      rt        j                  | «      nddœz  }dd|iz  }t        t        j                  |«      «      ‚d x}}t        | «      }|sÂdd	t	        j
                  «       v st        j                  t        «      rt        j                  t        «      nd	dt	        j
                  «       v st        j                  | «      rt        j                  | «      ndt        j                  |«      d
œz  }t        t        j                  |«      «      ‚d }d}| |z  }	d}
|	|
z  }t        |«      }|sêdd	t	        j
                  «       v st        j                  t        «      rt        j                  t        «      nd	dt	        j
                  «       v st        j                  | «      rt        j                  | «      ndt        j                  |«      t        j                  |
«      t        j                  |«      dœz  }t        t        j                  |«      «      ‚d x}x}	x}
x}}| j                  }t        |«      }	|	 }|sÖdd	t	        j
                  «       v st        j                  t        «      rt        j                  t        «      nd	dt	        j
                  «       v st        j                  | «      rt        j                  | «      ndt        j                  |«      t        j                  |	«      dœz  }t        t        j                  |«      «      ‚d x}x}	}| j                  }d}	||	z  }t        |«      }| }|sêdd	t	        j
                  «       v st        j                  t        «      rt        j                  t        «      nd	dt	        j
                  «       v st        j                  | «      rt        j                  | «      ndt        j                  |«      t        j                  |	«      t        j                  |«      dœz  }t        t        j                  |«      «      ‚d x}x}	x}x}}y ­w)Nr.   )z?%(py2)s
{%(py2)s = %(py0)s.allowed_workspaces_root
} == %(py4)sr>   r˜   ©ri   rŒ   r3   r4   r5   z,assert %(py3)s
{%(py3)s = %(py0)s(%(py1)s)
}r	   )ri   r2   r9   rÅ   ÚdeepzDassert %(py9)s
{%(py9)s = %(py0)s(((%(py1)s / %(py3)s) / %(py6)s))
})ri   r2   r9   r5   r�   zLassert not %(py5)s
{%(py5)s = %(py0)s(%(py3)s
{%(py3)s = %(py1)s.parent
})
}r¦   zworkspaces-copyzXassert not %(py8)s
{%(py8)s = %(py0)s((%(py3)s
{%(py3)s = %(py1)s.parent
} / %(py5)s))
}©ri   r2   r9   r:   r;   )r   Úallowed_workspaces_rootrF   rG   ro   rp   rq   rH   r   rI   r	   r”   )r˜   r)   r>   rs   rN   rP   rQ   rO   rt   rR   r}   rS   rr   r�   rT   r¾   s                   r    Ú/test_root_itself_is_inside_and_siblings_are_notrÌ   þ   sâ  è ø€ ô +Ó,€Hà×+Ñ+ÐFÐ+Ð/FÑF×F×FÕFÐ+Ð/F×F×F×F×F×FÑFˆ8×F×FÓFˆ8×F×FÔFÐ+×F×F×F×F×FÐFÐ/F×F×FÓFÐ/F×F×F×F×F×F×FÓFÜ$Ð%<Ó=Ð=Ñ=×=×=×=×=Õ=Ô$×=×=Ó=Ô$×=×=×=×=×=Ò=Ð%<×=×=Ó=Ð%<×=×=Ô=Ð=×=×=×=×=×=Ð=Ø?GÐQÐ%<¸xÑ%GÐQÈ&ÐQÐ%GÈ&Ñ%PÐQÔ$Ð%PÓQÐQÑQ×Q×Q×Q×QÕQÔ$×Q×QÓQÔ$×Q×Q×Q×Q×QÒQÐ%<×Q×QÓQÐ%<×Q×QÔQ¸x×Q×QÒQÈ&×Q×QÒQÐQ×Q×Q×Q×Q×Q×QÐQØ)@×)GÑ)GÐHÔ(Ð)GÓHÐHÐHÐHÐHÑH×H×H×H×HÕHÔ(×H×HÓHÔ(×H×H×H×H×HÒHÐ)@×H×HÓHÐ)@×H×HÔHÐ)G×H×HÒHÐH×H×H×H×H×HÔHØ)@×)GÑ)GÐ\ÐJ[Ð\Ð)GÐJ[Ñ)[Ð\Ô(Ð)[Ó\Ð\Ð\Ð\Ð\Ñ\×\×\×\×\Õ\Ô(×\×\Ó\Ô(×\×\×\×\×\Ò\Ð)@×\×\Ó\Ð)@×\×\Ô\Ð)G×\×\Ò\ÐJ[×\×\Ò\Ð\×\×\×\×\×\×\Ñ\ùs   ‚S,S.c              ƒ  ój  K  — |j                  dd„ «       t        «       }| dz  }|j                  «        t        j                  t
        d¬«      5  |j                  ddt        |«      ¬«      ƒ d {  –—†  d d d «       g }||k(  }|s™t        j                  d	|fd
||f«      dt        j                  «       v st        j                  |«      rt        j                  |«      ndt        j                  |«      dœz  }dd|iz  }	t        t        j                  |	«      «      ‚d x}}y 7 Œ³# 1 sw Y   Œ²xY w­w)Nú=cyberbrain26.execution_plane.bubblewrap_provider.shutil.whichc                 ó   — y ©N© ©Ú_s    r    ú<lambda>zLtest_confinement_is_checked_before_bubblewrap_availability.<locals>.<lambda>  ó   � r*   r¡   r£   r±   r¢   r,   r‡   r.   r§   r)   rh   r¥   r:   )r&   r   r“   r¨   r©   rª   rE   r–   rF   rG   ro   rp   rq   rH   r   rI   )
r¬   r˜   r(   r)   r>   r¡   rO   rs   rt   ru   s
             r    Ú:test_confinement_is_checked_before_bubblewrap_availabilityrÖ     sæ   è ø€ ð ×ÑØGÉôô +Ó,€HØ˜Ñ"€GØ‡M�M„Oä	�‰”zÐ)NÔ	Oñ ZØ×ÑÐ6¸ÌCÐPWËLÐÓY×YÐY÷Zð !#Ð"Ð Ñ"×"×"Õ"Ð ×"×"×"×"×"Ñ"Ð×"×"Ó"Ð×"×"Ô" ×"×"×"×"×"×"Ò"ð 	Zø÷Zð Züs1   ‚AD3Á!D'Á1D%Á2D'Á6B/D3Ä%D'Ä'D0Ä,D3c           	   ƒ  ó²  K  — | dz  }|j                  «        t        |¬«      }|dz  }|j                  «        |j                  ddt        |«      ¬«      ƒ d {  –—† }|d   }d}||k(  }|slt	        j
                  d	|fd
||f«      t	        j                  |«      t	        j                  |«      dœz  }	dd|	iz  }
t        t	        j                  |
«      «      ‚d x}x}}d}||z  }|j                  }d} ||¬«      }d}||k(  }|sét	        j
                  d	|fd||f«      dt        j                  «       v st	        j                  |«      rt	        j                  |«      ndt	        j                  |«      t	        j                  |«      t	        j                  |«      t	        j                  |«      t	        j                  |«      dœz  }dd|iz  }t        t	        j                  |«      «      ‚d x}x}x}x}x}x}}t        j                  t        d¬«      5  |j                  ddt        |«      ¬«      ƒ d {  –—†  d d d «       y 7 �Œí7 Œ# 1 sw Y   y xY w­w)Nzcustom-workspaces)Úworkspaces_rootÚprojectz%open('made-here.txt', 'w').write('x')r,   r‡   r-   r   r.   r0   r1   r4   r5   zmade-here.txtr„   r…   ÚxrŠ   rƒ   r‹   r�   r�   r£   r±   r¢   )r“   r   rE   r–   rF   rG   rH   r   rI   r—   ro   rp   rq   r¨   r©   rª   )r¬   r˜   Úcustom_rootr>   rƒ   rL   rM   rN   rO   rP   rQ   rs   rR   rT   rr   r™   rš   r›   rœ   s                      r    Ú3test_explicit_workspaces_root_confines_to_that_rootrÜ   !  sË  è ø€ ð Ð0Ñ0€KØ×ÑÔÜ*¸;ÔG€HØ˜iÑ'€IØ‡O�OÔà×#Ñ#Ø/°ÄSÈÃ^ð $ó ÷ €Fð �-Ñ Ð% AÐ%Ð  AÑ%×%×%Õ%Ð  A×%×%Ó%Ð ×%×%Ò% A×%×%×%×%×%×%Ó%Ø'ÐKˆI˜Ñ'ÐKÐ'×2Ñ2ÐK¸GÐKÑ2¸GÔDÐKÈÐKÐDÈÑK×K×KÕKÐDÈ×K×K×K×K×KÑKˆI×K×KÓKˆI×K×KÔK˜×K×KÒKÐ2×K×KÒK¸G×K×KÒKÐD×K×KÒKÈ×K×K×K×K×K×K×KÓKÜ	�‰”zÐ)NÔ	Oñ 
Ø×ÑØ# X¼Ð=TÓ9Uð ó 
÷ 	
ð 	
÷
ð 
ðùð	
ø÷
ð 
üs=   ‚AIÁIÁF=IÈ!IÈ8I	È9IÈ=
IÉ	IÉIÉIc           
   ƒ  ó°  K  — | dz  }|j                  «        |j                  dt        |«      «       t        «       }|dz  }|j                  «        |j	                  ddt        |«      ¬«      ƒ d {  –—† }|d   }d}||k(  }	|	slt        j                  d	|	fd
||f«      t        j                  |«      t        j                  |«      dœz  }
dd|
iz  }t        t        j                  |«      «      ‚d x}x}	}|d   }|j                  }	 |	«       }d}||k(  }|s”t        j                  d	|fd||f«      t        j                  |«      t        j                  |	«      t        j                  |«      t        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}x}	x}x}}t        j                  t        «      5 }|j	                  ddt        |«      ¬«      ƒ d {  –—†  d d d «       t        |«      }	j                  }t        |«      }|	|v }|�s”t        j                  d|fd|	|f«      dt        j                   «       v st        j"                  t        «      rt        j                  t        «      nddt        j                   «       v st        j"                  |«      rt        j                  |«      ndt        j                  |	«      dt        j                   «       v st        j"                  t        «      rt        j                  t        «      nddt        j                   «       v st        j"                  |«      rt        j                  |«      ndt        j                  |«      t        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}	x}x}}y 7 �ŒQ7 �ŒÖ# 1 sw Y   �ŒÖxY w­w)Nzenv-workspacesÚCYBERBRAIN_WORKSPACES_ROOTrÙ   zprint('env-ok')r,   r‡   r-   r   r.   r0   r1   r4   r5   r6   zenv-okr7   r8   r<   r=   r¢   ra   r¸   r–   Úenv_rootr­   rº   r»   rŽ   )r“   Úsetenvr–   r   rE   rF   rG   rH   r   rI   rJ   r¨   r©   rª   r«   ro   rp   rq   )r¬   r˜   r(   rß   r>   rƒ   rL   rM   rN   rO   rP   rQ   rR   rS   rT   rU   rV   r­   r¾   r›   s                       r    Ú$test_env_workspaces_root_is_honouredrá   :  s�  è ø€ ð
 Ð*Ñ*€HØ‡N�NÔØ×ÑÐ3´S¸³]ÔCÜ*Ó,€HØ˜9Ñ$€IØ‡O�OÔà×#Ñ#Ð$5°xÌ3ÈyË>Ð#ÓZ×Z€Fà�-Ñ Ð% AÐ%Ð  AÑ%×%×%Õ%Ð  A×%×%Ó%Ð ×%×%Ò% A×%×%×%×%×%×%Ó%Ø�(ÑÐ/Ð×!Ñ!Ð/Ñ!Ó#Ð/ xÐ/Ð# xÑ/×/×/Õ/Ð# x×/×/Ó/Ð×/×/Ò/Ð!×/×/Ò/Ð#×/×/Ò/ x×/×/×/×/×/×/×/ô 
�‰”zÓ	"ð 
 gØ×ÑØ# X¼Ð=TÓ9Uð ó 
÷ 	
ð 	
÷
ô ˆx‹=Ð. §¡Ð.œC Ó.Ð.ˆ=Ð.Ð.×.×.Ö.ˆ=Ð.×.×.×.×.×.Ñ.Œ3×.×.Ó.Œ3×.×.×.×.×.Ò.ˆx×.×.Ó.ˆx×.×.Ô.ˆ=×.×.×.×.×.Ð.œC×.×.Ó.œC×.×.×.×.×.Ò. ×.×.Ó. ×.×.Ô. ×.×.Ò.Ð.×.×.×.×.×.×.Ö.ð [ùð	
ù÷
ñ 
üs>   ‚A0OÁ2OÁ3EOÇ!O	Ç0OÇ1O	Ç5GOÏO	Ï	OÏOc                ól  — | dz  }|j                  dt        |«      «       |j                  dd¬«       t        «       }d}||z  }||k(  }|sÚt	        j
                  d|fd||f«      d	t        j                  «       v st	        j                  |«      rt	        j                  |«      nd	d
t        j                  «       v st	        j                  |«      rt	        j                  |«      nd
t	        j                  |«      dœz  }dd|iz  }t        t	        j                  |«      «      ‚d x}x}}|j                  } |«       }|s�dd	t        j                  «       v st	        j                  |«      rt	        j                  |«      nd	t	        j                  |«      t	        j                  |«      dœz  }	t        t	        j                  |	«      «      ‚d x}}t        j                  }t        j                  }
 |
|«      }|j                   } ||«      }d}||k(  }|�s�t	        j
                  d|fd||f«      dt        j                  «       v st	        j                  t        «      rt	        j                  t        «      ndt	        j                  |«      dt        j                  «       v st	        j                  t        «      rt	        j                  t        «      ndt	        j                  |
«      d	t        j                  «       v st	        j                  |«      rt	        j                  |«      nd	t	        j                  |«      t	        j                  |«      t	        j                  |«      t	        j                  |«      dœ	z  }dd|iz  }t        t	        j                  |«      «      ‚d x}x}
x}x}x}x}}y )Nz
fresh-dataÚCYBERBRAIN_DATA_DIRrÞ   F)ÚraisingÚ
workspacesr.   )z%(py0)s == (%(py2)s / %(py4)s)ÚrootÚdata_dirrÈ   úassert %(py7)sr`   zAassert %(py4)s
{%(py4)s = %(py2)s
{%(py2)s = %(py0)s.is_dir
}()
}iÀ  )z§%(py12)s
{%(py12)s = %(py2)s
{%(py2)s = %(py0)s.S_IMODE
}(%(py10)s
{%(py10)s = %(py8)s
{%(py8)s = %(py5)s
{%(py5)s = %(py3)s.stat
}(%(py6)s)
}.st_mode
})
} == %(py15)sÚstatÚos)	ri   rŒ   r9   r:   r5   r;   r=   rŽ   Úpy15zassert %(py17)sÚpy17)rà   r–   Údelenvr   rF   rG   ro   rp   rq   rH   r   rI   Úis_dirré   ÚS_IMODErê   Úst_mode)r¬   r(   rç   ræ   rN   r}   rs   ru   r®   rP   rR   rS   r¾   r™   Ú@py_assert14Ú@py_assert13Ú@py_format16Ú@py_format18s                     r    Ú;test_ensure_workspaces_root_creates_an_owner_only_directoryrõ   S  s   € ð ˜,Ñ&€HØ×ÑÐ,¬c°(«mÔ<Ø×ÑÐ3¸UÐÔCä!Ó#€Dà*Ð*�8˜lÑ*Ð*ˆ4Ð*Ñ*×*×*Õ*ˆ4Ð*×*×*×*×*×*Ñ*ˆ4×*×*Ó*ˆ4×*×*×*×*×*Ò*�8×*×*Ó*�8×*×*Ô*˜l×*×*×*×*×*×*Ó*Ø�;‰;Ð‰;‹=Ð‰=××××Õˆ4××Óˆ4××Ôˆ;××Òˆ=×××××ÒÜ�<‰<Ð7œŸ™Ð7™ ›Ð7˜×-Ñ-Ð7‰<Ð-Ó.Ð7°%Ð7Ð.°%Ñ7×7×7Ö7Ð.°%×7×7×7×7×7Ñ7Œ4×7×7Ó7Œ4×7×7Ô7ˆ<×7×7×7×7×7Ð7œ×7×7Ó7œ×7×7Ô7˜×7×7×7×7×7Ð7 ×7×7Ó7 ×7×7Ô7˜×7×7Ò7Ð-×7×7Ò7Ð.×7×7Ò7°%×7×7×7×7×7×7×7Ô7r*   c               ƒ  ón  K  — t        dd¬«      } | j                  ddd¬«      ƒ d {  –—† }| j                  dd«      ƒ d {  –—† }|d	   }d
}||u }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}x}}|d   }d}||k(  }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}x}}|d   }t        |«      }d}	||	k  }
|
sÉt        j                  d|
fd||	f«      dt        j                  «       v st        j                  t        «      rt        j                  t        «      ndt        j                  |«      t        j                  |«      t        j                  |	«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}x}x}
}	|d   }d
}||u }|slt        j                  d|fd||f«      t        j                  |«      t        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚d x}x}}y 7 �Œˆ7 �Œq­w)Ngš™™™™™É?é    )Úmax_timeout_secondsÚmax_output_byteszwhile True: passr,   é
   )Útimeout_secondszprint('x' * 1000)r@   TrA   rC   r1   r4   r5   r-   r   r.   r0   r6   )ú<=)z0%(py4)s
{%(py4)s = %(py0)s(%(py2)s)
} <= %(py7)srz   ©ri   rŒ   r3   r`   úassert %(py9)sr�   Ústdout_truncated)r   rE   rF   rG   rH   r   rI   rz   ro   rp   rq   )r>   r@   ÚnoisyrM   rN   rO   rP   rQ   rs   rT   r}   r®   r�   s                r    Ú(test_execution_times_out_and_caps_outputr  a  sÒ  è ø€ ô +ØØô€Hð ×&Ñ&Ð'9¸8ÐUWÐ&ÓX×X€IØ×"Ñ"Ð#6¸ÓA×A€Eà�[Ñ!Ð) TÐ)Ð! TÐ)×)×)Õ)Ð! T×)×)Ó)Ð!×)×)Ò) T×)×)×)×)×)×)Ó)Ø�ÑÐ$ 1Ð$Ð 1Ñ$×$×$Õ$Ð 1×$×$Ó$Ð×$×$Ò$ 1×$×$×$×$×$×$Ó$Ø�X‰Ð%Œ3ˆÓÐ% 2Ð%Ð 2Ñ%×%×%Õ%Ð 2×%×%×%×%×%Ñ%Œ3×%×%Ó%Œ3×%×%Ô%ˆ×%×%Ò%Ð×%×%Ò% 2×%×%×%×%×%×%Õ%ØÐ#Ñ$Ð,¨Ð,Ð$¨Ð,×,×,Õ,Ð$¨×,×,Ó,Ð$×,×,Ò,¨×,×,×,×,×,×,Ô,ð YùØAûs"   ‚%J5§J/¨J5ÁJ2ÁI.J5Ê2J5c               ƒ  ó¸   K  — t        «       } t        j                  t        d¬«      5  | j	                  dd«      ƒ d {  –—†  d d d «       y 7 Œ# 1 sw Y   y xY w­w)Nzunsupported execution languager±   zecho hiÚ
javascript)r   r¨   r©   rª   rE   )r>   s    r    Ú%test_unsupported_language_is_rejectedr  q  sP   è ø€ ä*Ó,€HÜ	�‰”zÐ)IÔ	Jñ 8Ø×Ñ˜y¨,Ó7×7Ð7÷8ð 8Ø7ø÷8ð 8üs,   ‚&A¨A¾A¿AÁ	AÁAÁAÁAc              ƒ  óÞ   K  — | j                  dd„ «       t        «       }t        j                  t        d¬«      5  |j                  dd«      ƒ d {  –—†  d d d «       y 7 Œ# 1 sw Y   y xY w­w)NrÎ   c                 ó   — y rÐ   rÑ   rÒ   s    r    rÔ   z6test_missing_bubblewrap_fails_closed.<locals>.<lambda>z  rÕ   r*   z&refusing to run code without a sandboxr±   r¢   r,   )r&   r   r¨   r©   ÚRuntimeErrorrE   )r(   r>   s     r    Ú$test_missing_bubblewrap_fails_closedr  x  sh   è ø€ à×ÑÐWÑYgÔhÜ*Ó,€Hä	�‰”|Ð+SÔ	Tñ BØ×ÑÐ6¸ÓA×AÐA÷Bð BØAø÷Bð Büs.   ‚9A-»A!ÁAÁA!Á	A-ÁA!Á!A*Á&A-c               ƒ  ó:
  ‡K  — t        «       } t        «       Št        ddt        j                  t
        j                  j                  h¬«      }t        t        «       t        t        «       | «      ‰| d¬«      }d$ˆfd„}t        j                   |«       «      }|j                  |ddd	¬
«      ƒ d {  –—† }|ƒ d {  –—†  |d   }d}||k(  }|slt        j                   d|fd||f«      t        j"                  |«      t        j"                  |«      dœz  }	dd|	iz  }
t%        t        j&                  |
«      «      ‚d x}x}}|d   }|j(                  } |«       }d}||k(  }|s”t        j                   d|fd||f«      t        j"                  |«      t        j"                  |«      t        j"                  |«      t        j"                  |«      dœz  }dd|iz  }t%        t        j&                  |«      «      ‚d x}x}x}x}}| j+                  t-        t.        j0                  d	¬«      «      }| j+                  t-        t.        j2                  d	¬«      «      }t5        |«      }d}||k(  }|söt        j                   d|fd||f«      dt7        j8                  «       v st        j:                  t4        «      rt        j"                  t4        «      nddt7        j8                  «       v st        j:                  |«      rt        j"                  |«      ndt        j"                  |«      t        j"                  |«      dœz  }
dd|
iz  }t%        t        j&                  |«      «      ‚d x}x}}t5        |«      }d}||k(  }|söt        j                   d|fd||f«      dt7        j8                  «       v st        j:                  t4        «      rt        j"                  t4        «      ndd t7        j8                  «       v st        j:                  |«      rt        j"                  |«      nd t        j"                  |«      t        j"                  |«      dœz  }
dd|
iz  }t%        t        j&                  |«      «      ‚d x}x}}|d   }|j<                  }d!}||k(  }|s€t        j                   d|fd"||f«      t        j"                  |«      t        j"                  |«      t        j"                  |«      d#œz  }
dd|
iz  }t%        t        j&                  |«      «      ‚d x}x}x}}y 7 �Œe7 �Œ^­w)%Núexecution-agentÚcoder©Útrust_levelÚscopesg      ð?©Úapproval_managerÚ	audit_logÚapproval_timeout_secondsc               “  óî   •K  — ‰j                  «       s.t        j                  d«      ƒ d {  –—†  ‰j                  «       sŒ.‰j                  «       d   } ‰j                  | j                  dd«       y 7 ŒF­w)Ng{®Gázt?r   ÚreviewerÚapproved)Úlist_pendingr'   ÚsleepÚapproveÚ
request_id)ÚrequestÚ	approvalss    €r    Úapprove_when_requestedz^test_authorized_execution_waits_for_approval_and_audits_result.<locals>.approve_when_requested”  sc   øè ø€ Ø×(Ñ(Ô*Ü—-‘- Ó&×&Ð&ð ×(Ñ(Õ*à×(Ñ(Ó*¨1Ñ-ˆØ×Ñ˜'×,Ñ,¨j¸*ÕEð 'ús   ƒ)A5¬A3­A5Á2A5zprintf 'authorized\n'r€   zexecution-task-1©Útask_idr-   r   r.   r0   r1   r4   r5   r6   Ú
authorizedr7   r8   r<   r=   ©Ú
event_typer  rd   ©z0%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} == %(py6)srz   Úgrantedr|   úassert %(py8)sr;   Ú	completedÚ	succeeded)z.%(py3)s
{%(py3)s = %(py1)s.result
} == %(py6)s©r2   r9   r5   ©r$   r%   )r   r   r   r   ÚTRUSTEDr   ÚSHELLr«   r   r   r   r   r'   Úcreate_taskrE   rF   rG   rH   r   rI   rJ   Úqueryr   r   ÚAPPROVAL_GRANTEDÚTOOL_RESULTrz   ro   rp   rq   rL   )ÚauditÚidentityÚservicer  Úapproval_taskrL   rM   rN   rO   rP   rQ   rR   rS   rT   rU   rV   r#  r%  r}   r  s                      @r    Ú>test_authorized_execution_waits_for_approval_and_audits_resultr3  �  sR  øè ø€ ô ‹J€EÜÓ!€IÜØØÜ×&Ñ&Ü×%Ñ%×+Ñ+Ð,ô	€Hô )Ü#Ó%Üœ,›.¨%Ó0Ø"ØØ!$ô€GõFô ×'Ñ'Ñ(>Ó(@ÓA€MØ—?‘?ØØ ØØ"ð	 #ó ÷ €Fð ×Ðà�-Ñ Ð% AÐ%Ð  AÑ%×%×%Õ%Ð  A×%×%Ó%Ð ×%×%Ò% A×%×%×%×%×%×%Ó%Ø�(ÑÐ3Ð×!Ñ!Ð3Ñ!Ó#Ð3 |Ð3Ð# |Ñ3×3×3Õ3Ð# |×3×3Ó3Ð×3×3Ò3Ð!×3×3Ò3Ð#×3×3Ò3 |×3×3×3×3×3×3×3Ø�k‰kÜœn×=Ñ=ÐGYÔZó€Gð —‘Üœn×8Ñ8ÐBTÔUó€Iô ˆw‹<Ð˜1Ðˆ<˜1Ñ××Õˆ<˜1×××××ÑŒ3××ÓŒ3×××××Òˆw××Óˆw××Ôˆ<××Ò˜1××××××ÓÜˆy‹>Ð˜QÐˆ>˜QÑ××Õˆ>˜Q×××××ÑŒ3××ÓŒ3×××××Òˆy××Óˆy××Ôˆ>××Ò˜Q××××××ÓØ�Q‰<Ð-ˆ<×ÑÐ- +Ð-Ð +Ñ-×-×-Õ-Ð +×-×-Ó-ˆ<×-×-Ò-Ð×-×-Ò- +×-×-×-×-×-×-Ö-ð%ùð ûs%   ƒB-TÂ0TÂ1	TÂ:TÂ;QTÔTc               ƒ  óÌ  K  —  G d„ d«      }  | «       }t        |t        t        «       «      «      }t        ddt        j
                  ¬«      }t        j                  t        d¬«      5  |j                  |dd	d
¬«      ƒ d {  –—†  d d d «       |j                  }d}||u }|s­t        j                  d|fd||f«      dt        j                  «       v st        j                  |«      rt        j                   |«      ndt        j                   |«      t        j                   |«      dœz  }dd|iz  }t#        t        j$                  |«      «      ‚d x}x}}y 7 ŒÔ# 1 sw Y   ŒÓxY w­w)Nc                  ó   — e Zd ZdZdZdd„Zy)ú]test_authorized_execution_denies_missing_scope_before_provider_call.<locals>.NeverRunProviderÚtestFc              Ÿ  ó    K  — d| _         ddiS ­w)NTr-   r   )Úcalled©Úselfr   r   s      r    rE   zetest_authorized_execution_denies_missing_scope_before_provider_call.<locals>.NeverRunProvider.execute¶  s   è ø€ ØˆDŒKØ! 1Ð%Ð%ùs   ‚N©r   r#   r   r#   r$   zdict[str, object])Ú__name__Ú
__module__Ú__qualname__Úprovider_namer9  rE   rÑ   r*   r    ÚNeverRunProviderr6  ²  s   „ ØˆØˆô	&r*   rA  zno-scoper  )r  zlacks required scoper±   zprint('no')r,   zexecution-task-deniedr  FrA   )z.%(py2)s
{%(py2)s = %(py0)s.called
} is %(py5)sr>   ©ri   rŒ   r:   rè   r`   )r   r   r   r   r   r)  r¨   r©   r   rE   r9  rF   rG   ro   rp   rq   rH   r   rI   )	rA  r>   r1  r0  rs   rR   rN   ru   r®   s	            r    ÚCtest_authorized_execution_denies_missing_scope_before_provider_callrC  °  s  è ø€ ÷&ñ &ñ  Ó!€HÜ(ØÜœ,›.Ó)ó€Gô ˜Z¨¼j×>PÑ>PÔQ€Hä	�‰”}Ð,BÔ	Cñ 
Ø�o‰oØØØØ+ð	 ó 
÷ 	
ð 	
÷
ð �?‰?Ð#˜eÐ#ˆ?˜eÐ#×#×#Õ#ˆ?˜e×#×#×#×#×#Ñ#ˆ8×#×#Ó#ˆ8×#×#Ô#ˆ?×#×#Ò#˜e×#×#×#×#×#×#Ô#ð	
ø÷
ð 
üs1   ‚A&E$Á(EÂEÂEÂCE$ÅEÅE!ÅE$c                  ó$   — e Zd ZdZdZdd„Zdd„Zy)Ú_NeverRunProviderzAExecution provider that records the payloads it was asked to run.z	never-runc                ó   — g | _         y rÐ   )Úcalls)r;  s    r    Ú__init__z_NeverRunProvider.__init__Ó  s	   € Ø/1ˆ�
r*   c              �  óH   K  — | j                   j                  |«       ddiS ­w)Nr-   r   )rG  r   r:  s      r    rE   z_NeverRunProvider.executeÖ  s#   è ø€ Ø�
‰
×Ñ˜$ÔØ˜qÐ!Ð!ùs   ‚ "Nr(  r<  )r=  r>  r?  Ú__doc__r@  rH  rE   rÑ   r*   r    rE  rE  Î  s   „ ÙKà€Mó2ô"r*   rE  r‡   c               óˆ  — | j                  ||dddi¬«      }| j                  }|j                  }d}	d}
 |||	|
«      }d}||u}|�s>t        j                  d|fd||f«      d	t        j                  «       v st        j                  | «      rt        j                  | «      nd	t        j                  |«      d
t        j                  «       v st        j                  |«      rt        j                  |«      nd
t        j                  |«      t        j                  |	«      t        j                  |
«      t        j                  |«      t        j                  |«      dœz  }dd|iz  }t        t        j                  |«      «      ‚dx}x}x}	x}
x}x}}t        |j                  d|dt        |||¬«      |j                  ¬«      S )z?Return a grant backed by a genuinely approved approval request.Nr  Úouter)Úcontextr  r  ©úis not)z†%(py11)s
{%(py11)s = %(py2)s
{%(py2)s = %(py0)s.approve
}(%(py5)s
{%(py5)s = %(py3)s.request_id
}, %(py7)s, %(py9)s)
} is not %(py14)sr  r  )ri   rŒ   r9   r:   r`   r�   r’   r�   zassert %(py16)sÚpy16©ÚcodeÚlanguagerƒ   ©Úagent_idr  ÚactionÚresourceÚpayload_digestÚapproval_request_id)Úcreate_requestr  r  rF   rG   ro   rp   rq   rH   r   rI   r
   rU  r   )r  r0  rV  rR  rS  rƒ   r  rs   rR   rT   rr   rš   rò   Ú@py_assert12rœ   Ú@py_format17s                   r    Ú_approved_grantr]  Û  sG  € ð ×&Ñ& x°¸È	ÐSZÐG[Ð&Ó\€GØ×ÑÐT˜W×/Ñ/ÐT°ÐT¸ZÐTÑÐ/°¸ZÓHÐTÐPTÐTÐHÐPTÐT×T×TÖTÐHÐPT×T×T×T×T×TÑTˆ9×T×TÓTˆ9×T×TÔTÐ×T×T×T×T×TÐT˜W×T×TÓT˜W×T×TÔTÐ/×T×TÒT°×T×TÒT¸Z×T×TÒTÐH×T×TÒTÐPT×T×T×T×T×T×T×TÓTÜ!Ø×"Ñ"ØØØÜ/Ø °Iô
ð $×.Ñ.ô	ð 	r*   c            	   ƒ  ó  K  — t        «       } t        ddt        j                  t        j
                  j                  h¬«      }t        «       }t        |t        t        «       «      | d¬«      }t        | |ddd¬	«      }t        |«      5  t        j                  t        d
¬«      5  |j!                  |ddd¬«      ƒ d{  –—†  ddd«       ddd«       |j"                  }g }||k(  }|s­t%        j&                  d|fd||f«      dt)        j*                  «       v st%        j,                  |«      rt%        j.                  |«      ndt%        j.                  |«      t%        j.                  |«      dœz  }dd|iz  }	t1        t%        j2                  |	«      «      ‚dx}x}}| j4                  }
 |
«       }t7        |«      }d}||k(  }|�st%        j&                  d|fd||f«      dt)        j*                  «       v st%        j,                  t6        «      rt%        j.                  t6        «      nddt)        j*                  «       v st%        j,                  | «      rt%        j.                  | «      ndt%        j.                  |
«      t%        j.                  |«      t%        j.                  |«      t%        j.                  |«      dœz  }dd|iz  }t1        t%        j2                  |«      «      ‚dx}
x}x}x}}y7 �Œ.# 1 sw Y   �Œ.xY w# 1 sw Y   �Œ3xY w­w)aò  A human approved one piece of code; only that code may reach a provider.

    This is the security-critical half of the single-approval flow. The outer
    gate got one approval and the inner gateway must not ask a second time, but
    it must also not run a payload the operator never saw. The grant is bound to
    a digest of the approved payload, so swapping the code between the two
    checks has to be refused outright - the provider is never reached and no new
    approval is created.
    r
  r  r  çš™™™™™©?©r  r  Úexecute_pythonúprint('approved')r,   ©rR  rS  zdoes not cover this executionr±   zprint('swapped after approval')zpayload-swapr  Nr.   ©z-%(py2)s
{%(py2)s = %(py0)s.calls
} == %(py5)sr>   rB  rè   r`   rd   )zj%(py7)s
{%(py7)s = %(py0)s(%(py5)s
{%(py5)s = %(py3)s
{%(py3)s = %(py1)s.list_records
}()
})
} == %(py10)srz   r  )ri   r2   r9   r:   r`   r=   r»   rŽ   )r   r   r   r)  r   ÚPYTHONr«   rE  r   r   r   r]  r   r¨   r©   r   rE   rG  rF   rG   ro   rp   rq   rH   r   rI   Úlist_recordsrz   )r  r0  r>   r1  Úgrantrs   rR   rN   ru   r®   rO   rT   r¾   rr   rV   r›   s                   r    ÚDtest_gateway_refuses_a_payload_that_changed_after_the_outer_approvalrh  ó  s  è ø€ ô  Ó!€IÜØØÜ×&Ñ&Ü×&Ñ&×,Ñ,Ð-ô	€Hô !Ó"€HÜ(ØÜœ,›.Ó)Ø"Ø!%ô	€Gô Ø�8Ð-Ð4GÐRZô€Eô 
' uÓ	-ñ Ü�]‰]Ô+Ð3RÔSñ 	Ø—/‘/ØØ1ØØ&ð	 "ó ÷ ð ÷	÷ð �>‰>Ð˜RÐˆ>˜RÑ××Õˆ>˜R×××××Ñˆ8××Óˆ8××Ôˆ>××Ò˜R××××××Óà×%Ñ%Ð-Ñ%Ó'Ð-Œ3Ð'Ó(Ð-¨AÐ-Ð(¨AÑ-×-×-Ö-Ð(¨A×-×-×-×-×-Ñ-Œ3×-×-Ó-Œ3×-×-×-×-×-Ò-ˆy×-×-Ó-ˆy×-×-Ô-Ð%×-×-Ò-Ð'×-×-Ò-Ð(×-×-Ò-¨A×-×-×-×-×-×-×-Ð-ðù÷	ñ 	ú÷ñ üsI   ‚BLÂK;Â$K.Â=K+Â>K.ÃK;Ã
H!LË+K.Ë.K8	Ë3K;Ë;LÌ Lc               ƒ  ór  K  — t        «       } t        ddt        j                  t        j
                  j                  t        j                  j                  h¬«      }t        «       }t        |t        t        «       «      | d¬«      }t        | |ddd¬	«      }t        |«      5  t        j                  t         d
¬«      5  |j#                  |ddd¬«      ƒ d{  –—†  ddd«       ddd«       |j$                  }g }||k(  }|s­t'        j(                  d|fd||f«      dt+        j,                  «       v st'        j.                  |«      rt'        j0                  |«      ndt'        j0                  |«      t'        j0                  |«      dœz  }dd|iz  }	t3        t'        j4                  |	«      «      ‚dx}x}}| j7                  |j8                  xs d«      fD �
cg c]  }
|
�|
‘Œ }}
t;        |«      }d}||k(  }|söt'        j(                  d|fd||f«      dt+        j,                  «       v st'        j.                  t:        «      rt'        j0                  t:        «      nddt+        j,                  «       v st'        j.                  |«      rt'        j0                  |«      ndt'        j0                  |«      t'        j0                  |«      dœz  }dd|iz  }t3        t'        j4                  |«      «      ‚dx}x}}|d   }|j<                  }d}||k(  }|s€t'        j(                  d|fd ||f«      t'        j0                  |«      t'        j0                  |«      t'        j0                  |«      d!œz  }dd|iz  }t3        t'        j4                  |«      «      ‚dx}x}x}}y7 �Œ¿# 1 sw Y   �Œ¿xY w# 1 sw Y   �ŒÄxY wc c}
w ­w)"a  A grant for one action is ignored, not honoured, when another is run.

    An approval for ``execute_python`` says nothing about ``execute_shell``, so
    the gateway must fall back to its own full gate for the action it is really
    performing rather than reusing the grant.
    r
  r  r  r_  r`  ra  rb  r,   rc  Úexecute_shellr±   zecho approvedr€   zaction-swapr  Nr.   rd  r>   rB  rè   r`   Ú rd   r"  rz   Úpending_or_decidedr|   r$  r;   r   )z.%(py3)s
{%(py3)s = %(py1)s.action
} == %(py6)sr'  )r   r   r   r)  r   re  r«   r*  rE  r   r   r   r]  r   r¨   r©   r   rE   rG  rF   rG   ro   rp   rq   rH   r   rI   Úget_requestrY  rz   rV  )r  r0  r>   r1  rg  rs   rR   rN   ru   r®   Úrrl  rO   r}   rQ   rU   rM   s                    r    Ú6test_approval_for_action_a_does_not_authorise_action_bro    s«  è ø€ ô  Ó!€IÜØØÜ×&Ñ&Ü×&Ñ&×,Ñ,¬o×.CÑ.C×.IÑ.IÐJô	€Hô !Ó"€HÜ(ØÜœ,›.Ó)Ø"Ø!%ô	€Gô Ø�8Ð-Ð4GÐRZô€Eô 
' uÓ	-ñ Ü�]‰]Ô+°?ÔCñ 	Ø—/‘/Ø˜/¨7¸Mð "ó ÷ ð ÷	÷ð �>‰>Ð˜RÐˆ>˜RÑ××Õˆ>˜R×××××Ñˆ8××Óˆ8××Ôˆ>××Ò˜R××××××Óð ×)Ñ)¨%×*CÑ*CÒ*IÀrÓJÐKöØØˆ=ò 	
ðÐð ô Ð!Ó"Ð' aÐ'Ð" aÑ'×'×'Õ'Ð" a×'×'×'×'×'Ñ'Œ3×'×'Ó'Œ3×'×'×'×'×'Ò'Ð!×'×'Ó'Ð!×'×'Ô'Ð"×'×'Ò' a×'×'×'×'×'×'Ó'Ø˜aÑ Ð;Ð ×'Ñ'Ð;Ð+;Ð;Ð'Ð+;Ñ;×;×;Õ;Ð'Ð+;×;×;Ó;Ð ×;×;Ò;Ð'×;×;Ò;Ð+;×;×;×;×;×;×;Ö;ðù÷	ñ 	ú÷ñ üòùsV   ‚BN7Â!N%Â=NÃNÃNÃN%Ã#C2N7ÇN2Ç F5N7ÎNÎN"	ÎN%Î%N/Î*N7c               ƒ  ó  K  — t        «       } t        ddt        j                  t        j
                  j                  h¬«      }t        «       }t        «       }t        |t        t        «       |«      | |d¬«      }t        | |ddd¬	«      }t        |«      5  |j                  |ddd
¬«      ƒ d{  –—†  ddd«       |j                  }t!        |«      }d}||k(  }	|	�s
t#        j$                  d|	fd||f«      dt'        j(                  «       v st#        j*                  t         «      rt#        j,                  t         «      nddt'        j(                  «       v st#        j*                  |«      rt#        j,                  |«      ndt#        j,                  |«      t#        j,                  |«      t#        j,                  |«      dœz  }
dd|
iz  }t/        t#        j0                  |«      «      ‚dx}x}x}	}|j3                  t5        t6        j8                  d
¬«      «      }|D �cg c]  }|j:                  ‘Œ }}dg}||k(  }|slt#        j$                  d|fd||f«      t#        j,                  |«      t#        j,                  |«      dœz  }dd|iz  }t/        t#        j0                  |«      «      ‚dx}x}}d}|j3                  t5        t6        j<                  ¬«      «      D �cg c]  }|j:                  ‘Œ }}||v }|slt#        j$                  d|fd||f«      t#        j,                  |«      t#        j,                  |«      dœz  }dd|iz  }t/        t#        j0                  |«      «      ‚dx}x}}y7 �Œº# 1 sw Y   �ŒºxY wc c}w c c}w ­w)zGThe happy path: one human decision, both gates, the code actually runs.r
  r  r  r_  r  ra  rb  r,   rc  zreuse-happy-pathr  Nrd   r.   )zK%(py5)s
{%(py5)s = %(py0)s(%(py3)s
{%(py3)s = %(py1)s.calls
})
} == %(py8)srz   r>   rÊ   r<   r=   r   Úreusedr0   r1   r4   r5   Úscope_check_passed)r!  ra   rc   )r   r   r   r)  r   re  r«   r   rE  r   r   r   r]  r   rE   rG  rz   rF   rG   ro   rp   rq   rH   r   rI   r,  r   r   r-  rL   ÚPERMISSION_CHECK)r  r0  r/  r>   r1  rg  rO   rR   rS   rT   rU   rV   r#  ÚeventrM   rN   rP   rQ   s                     r    Ú?test_unchanged_payload_reuses_the_outer_approval_and_still_runsru  I  s´  è ø€ ô  Ó!€IÜØØÜ×&Ñ&Ü×&Ñ&×,Ñ,Ð-ô	€Hô ‹J€EÜ Ó"€HÜ(ØÜœ,›.¨%Ó0Ø"ØØ!%ô€Gô Ø�8Ð-Ð4GÐRZô€Eô 
' uÓ	-ñ 
Ø�o‰oØÐ)¨8Ð=Oð ó 
÷ 	
ð 	
÷
ð
 �~‰~Ð#Œ3ˆ~ÓÐ# !Ð#Ð !Ñ#×#×#Ö#Ð !×#×#×#×#×#Ñ#Œ3×#×#Ó#Œ3×#×#×#×#×#Ò#ˆx×#×#Ó#ˆx×#×#Ô#ˆ~×#×#Ò#Ð×#×#Ò# !×#×#×#×#×#×#Õ#Ø�k‰kÜœn×=Ñ=ÐGYÔZó€Gð '.Ö.˜UˆE�L‹LÐ.Ð<Ð.°8°*Ð<Ð.°*Ñ<×<×<Õ<Ð.°*×<×<Ó<Ð.×<×<Ò<°*×<×<×<×<×<×<Ó<ð  ð ¸e¿k¹kÜœn×=Ñ=Ô>ó?ö $°U E§L£Lð $ð ð $Ðð $ð ÷ ïé óÐð $÷ ñ ïé ð  ÷ ð ïé ð$÷ ÷ ÷ ñ ïé ÷÷ ð ð	
ù÷
ñ 
üò /ùò$ùsK   ‚BNÂM*Â-M'Â.M*Â2E)NÈM7È.B+NËM<Ë,A;NÍ'M*Í*M4Í/Nc               ƒ  ó8  K  — t        «       } t        ddt        j                  t        j
                  j                  h¬«      }t        «       }t        |t        t        «       «      | d¬«      }| j                  |dd«      }t        |j                  dddt        d	d
d¬«      |j                  ¬«      }| j                   }|j                  } ||«      }d}	||	u}
|
�st#        j$                  d|
fd||	f«      dt'        j(                  «       v st#        j*                  | «      rt#        j,                  | «      ndt#        j,                  |«      dt'        j(                  «       v st#        j*                  |«      rt#        j,                  |«      ndt#        j,                  |«      t#        j,                  |«      t#        j,                  |	«      dœz  }dd|iz  }t/        t#        j0                  |«      «      ‚dx}x}x}x}
}	t3        |«      5  t5        j6                  t8        d¬«      5  |j;                  |d	d
d¬«      ƒ d{  –—†  ddd«       ddd«       |j<                  }g }||k(  }|s­t#        j$                  d|fd||f«      dt'        j(                  «       v st#        j*                  |«      rt#        j,                  |«      ndt#        j,                  |«      t#        j,                  |«      dœz  }dd|iz  }t/        t#        j0                  |«      «      ‚dx}x}}| j>                  } |«       }g }||k(  }|sÁt#        j$                  d|fd||f«      dt'        j(                  «       v st#        j*                  | «      rt#        j,                  | «      ndt#        j,                  |«      t#        j,                  |«      t#        j,                  |«      dœz  }dd |iz  }t/        t#        j0                  |«      «      ‚dx}x}x}}y7 �ŒÃ# 1 sw Y   �ŒÃxY w# 1 sw Y   �ŒÈxY w­w)!a5  A grant is a claim made at dispatch time; it is re-read, not trusted.

    The request behind it was cancelled instead of approved, so the grant no
    longer describes a human decision. The gateway must fall back to its own
    full gate and ask - strictly stronger than honouring an unverifiable claim.
    r
  r  r  r_  r`  ra  NrL  rb  r,   rQ  rT  rN  )zq%(py7)s
{%(py7)s = %(py2)s
{%(py2)s = %(py0)s.cancel
}(%(py5)s
{%(py5)s = %(py3)s.request_id
})
} is not %(py10)sr  r  )ri   rŒ   r9   r:   r`   r=   r»   rŽ   r±   Ú	withdrawnr  r.   rd  r>   rB  rè   r`   ©zK%(py4)s
{%(py4)s = %(py2)s
{%(py2)s = %(py0)s.list_records
}()
} == %(py7)srý   rþ   r�   ) r   r   r   r)  r   re  r«   rE  r   r   r   rZ  r
   rU  r   r  ÚcancelrF   rG   ro   rp   rq   rH   r   rI   r   r¨   r©   r   rE   rG  rf  )r  r0  r>   r1  r  rg  rs   rR   rT   r¾   rr   rV   r›   rN   ru   r®   r}   r�   s                     r    Ú=test_grant_is_ignored_once_its_approval_is_no_longer_approvedrz  r  sÓ  è ø€ ô  Ó!€IÜØØÜ×&Ñ&Ü×&Ñ&×,Ñ,Ð-ô	€Hô !Ó"€HÜ(ØÜœ,›.Ó)Ø"Ø!%ô	€Gð ×&Ñ& xÐ1AÀ4ÓH€GÜ"Ø×"Ñ"ØØØÜ/Ø$¨xÀ4ô
ð $×.Ñ.ô	€Eð ×ÑÐ;˜G×.Ñ.Ð;ÑÐ.Ó/Ð;°tÐ;Ð/°tÐ;×;×;Ö;Ð/°t×;×;×;×;×;Ñ;ˆ9×;×;Ó;ˆ9×;×;Ô;Ð×;×;×;×;×;Ð;˜G×;×;Ó;˜G×;×;Ô;Ð.×;×;Ò;Ð/×;×;Ò;°t×;×;×;×;×;×;×;ä	& uÓ	-ñ Ü�]‰]Ô+Ð3CÔDñ 	Ø—/‘/ØÐ-¨xÀð "ó ÷ ð ÷	÷ð �>‰>Ð˜RÐˆ>˜RÑ××Õˆ>˜R×××××Ñˆ8××Óˆ8××Ôˆ>××Ò˜R××××××ÓØ×!Ñ!Ð)Ñ!Ó#Ð) rÐ)Ð# rÑ)×)×)Õ)Ð# r×)×)×)×)×)Ñ)ˆ9×)×)Ó)ˆ9×)×)Ô)Ð!×)×)Ò)Ð#×)×)Ò) r×)×)×)×)×)×)Ö)ðù÷	ñ 	ú÷ñ üsI   ‚HPÈPÈ!P È:O=È;P È?PÉF6PÏ=P Ð P
	ÐPÐPÐPc               ƒ  ól  K  — t        «       } t        ddt        j                  t        j
                  j                  h¬«      }t        «       }t        |t        t        «       «      | d¬«      }t        |j                  dddt        d	d
d¬«      d¬«      }t        |«      5  t        j                   t"        d¬«      5  |j%                  |d	d
d¬«      ƒ d{  –—†  ddd«       ddd«       |j&                  }g }||k(  }|s­t)        j*                  d|fd||f«      dt-        j.                  «       v st)        j0                  |«      rt)        j2                  |«      ndt)        j2                  |«      t)        j2                  |«      dœz  }dd|iz  }	t5        t)        j6                  |	«      «      ‚dx}x}}| j8                  } |«       }g }
||
k(  }|sÁt)        j*                  d|fd||
f«      dt-        j.                  «       v st)        j0                  | «      rt)        j2                  | «      ndt)        j2                  |«      t)        j2                  |«      t)        j2                  |
«      dœz  }	dd|	iz  }t5        t)        j6                  |«      «      ‚dx}x}x}}
y7 �ŒÃ# 1 sw Y   �ŒÃxY w# 1 sw Y   �ŒÈxY w­w)zGA policy "allow" carries no human decision and cannot stand in for one.r
  r  r  r_  r`  rL  ra  Nzprint('allowed')r,   rQ  rT  r±   zno-humanr  r.   rd  r>   rB  rè   r`   rx  r  rý   rþ   r�   )r   r   r   r)  r   re  r«   rE  r   r   r   r
   rU  r   r   r¨   r©   r   rE   rG  rF   rG   ro   rp   rq   rH   r   rI   rf  )r  r0  r>   r1  rg  rs   rR   rN   ru   r®   rT   r}   r�   s                r    Ú:test_outer_allow_without_a_human_decision_is_never_a_grantr|     sø  è ø€ ô  Ó!€IÜØØÜ×&Ñ&Ü×&Ñ&×,Ñ,Ð-ô	€Hô !Ó"€HÜ(ØÜœ,›.Ó)Ø"Ø!%ô	€Gô #Ø×"Ñ"ØØØÜ/Ø#¨hÀ$ô
ð !ô	€Eô 
' uÓ	-ñ Ü�]‰]Ô+Ð3CÔDñ 	Ø—/‘/ØÐ,¨hÀ
ð "ó ÷ ð ÷	÷ð �>‰>Ð˜RÐˆ>˜RÑ××Õˆ>˜R×××××Ñˆ8××Óˆ8××Ôˆ>××Ò˜R××××××ÓØ×!Ñ!Ð)Ñ!Ó#Ð) rÐ)Ð# rÑ)×)×)Õ)Ð# r×)×)×)×)×)Ñ)ˆ9×)×)Ó)ˆ9×)×)Ô)Ð!×)×)Ò)Ð#×)×)Ò) r×)×)×)×)×)×)Ö)ðù÷	ñ 	ú÷ñ üsI   ‚BJ4ÂJ'Â;JÃJÃJÃJ'Ã!F6J4ÊJÊJ$	ÊJ'Ê'J1Ê,J4)r(   úpytest.MonkeyPatchr$   úlist[tuple[object, ...]]r(  )r˜   r   r$   r%   )r¬   r   r˜   r   r)   r~  r$   r%   )r˜   r   r)   r~  r$   r%   )
r¬   r   r˜   r   r(   r}  r)   r~  r$   r%   )r¬   r   r˜   r   r$   r%   )r¬   r   r˜   r   r(   r}  r$   r%   )r¬   r   r(   r}  r$   r%   )r(   r}  r$   r%   )r  r   r0  r   rV  r–   rR  r#   rS  r#   rƒ   r#   r$   r
   )KrJ  Ú
__future__r   Úbuiltinsro   Ú_pytest.assertion.rewriteÚ	assertionÚrewriterF   r'   rê   Úshutilré   Úpathlibr   r¨   Úcyberbrain26.execution_planer   r   r   Ú cyberbrain26.product.local_storer   r	   Ú#cyberbrain26.security_plane.actionsr
   r   r   Ú$cyberbrain26.security_plane.approvalr   Ú!cyberbrain26.security_plane.auditr   r   r   Ú$cyberbrain26.security_plane.identityr   r   r   Ú&cyberbrain26.security_plane.permissionr   r   Ú"cyberbrain26.security_plane.policyr   ÚmarkÚskipifÚwhichÚrequires_bubblewrapÚfixturer)   rW   rY   rv   r~   r�   rŸ   r¯   rµ   r¿   rÆ   rÌ   rÖ   rÜ   rá   rõ   r  r  r  r3  rC  rE  r]  rh  ro  ru  rz  r|  rÑ   r*   r    ú<module>r“     s]  ðÙ ;å "ç  „ ƒÛ 	Û Û Ý ã ÷ñ ÷
 _÷ñ õ
 Aß RÑ Rß [Ñ [ß SÝ ;à—k‘k×(Ñ(Ø€F‡L�L�Ó˜TÐ!Ð*Eð )ó Ð ð
 ‡�òó ðð  ‡�×ÑØò(ó ó ð(ð ‡�×ÑØò0ó ó ð0ð ‡�×ÑØòWó ó ðWð> ‡�×ÑØòMó ó ðMð( ‡�×ÑØò2ó ó ð2ð ‡�×ÑØð?Ø!ð?à	ò?ó ó ð?ðB ‡�×Ñð#Øð#à!ð#ð 0ð#ð 
ò	#ó ð#ð& ‡�×Ñð
#Ø!ð
#à/ð
#ð 
ò
#ó ð
#ð ‡�×Ñð#Øð#à!ð#ð 0ð#ð 
ò	#ó ð#ð* ‡�×Ñð#Øð#à!ð#ð $ð#ð 0ð	#ð
 
ò#ó ð#ð( ‡�×Ñð	]Ø!ð	]Ø6Nð	]à	ò	]ó ð	]ð ‡�×Ñð#Øð#à!ð#ð $ð#ð 0ð	#ð
 
ò#ó ð#ð* ‡�×ÑØð
Øð
Ø-1ð
à	ò
ó ó ð
ð. ‡�×ÑØð/Øð/Ø-1ð/Ø@Rð/à	ò/ó ó ð/ð.8Øð8Ø!3ð8à	ó8ð ‡�×ÑØò-ó ó ð-ð ‡�×Ñò8ó ð8ð ‡�×ÑòBó ðBð ‡�×ÑØò*.ó ó ð*.ðZ ‡�×Ñò$ó ð$÷:
"ñ 
"ð( ñØðàðð ðð
 ðð ðð ðð óð0 ‡�×Ñò'.ó ð'.ðT ‡�×Ñò'<ó ð'<ðT ‡�×Ñò%ó ð%ðP ‡�×Ñò**ó ð**ðZ ‡�×Ñò"*ó ñ"*r*   