RomanNum3ral
/
paperclip
mirror of https://github.com/paperclipai/paperclip.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

test: prove Codex Linux sandbox before paid invocation

This commit is contained in:
Dotta 2026-09-11 13:52:04 -05:00
parent 93bf987780
commit 16986ca1c8
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
tests/runner-e2e/codex-ci-sandbox.ts
View File

@ -1,6 +1,6 @@
import { execFileSync } from "node:child_process";
import { createHash } from "node:crypto";
import { readFile, realpath, writeFile } from "node:fs/promises";
import { mkdir, readFile, realpath, writeFile } from "node:fs/promises";
import { createRequire } from "node:module";
import path from "node:path";
@ -34,4 +34,12 @@ export async function prepareCodexCiSandbox(repositoryRoot: string, temporaryRoo
await writeFile(profilePath, codexUserNamespaceProfile(binary), { mode: 0o600 });
// sudo is noninteractive and bounded. Failure is a preflight error, before any model invocation.
execFileSync("sudo", ["-n", "apparmor_parser", "-r", profilePath], { timeout: 15_000, stdio: "pipe" });
const probeHome = path.join(temporaryRoot, "codex-sandbox-probe");
await mkdir(probeHome, { mode: 0o700 });
execFileSync(binary, ["sandbox", "-C", temporaryRoot, "--", "/bin/true"], {
cwd: temporaryRoot,
env: { PATH: process.env.PATH, CODEX_HOME: probeHome },
timeout: 15_000,
stdio: "pipe",
});
}