diff --git a/backend/tests/test_edge_sandbox_mirrors_backend.py b/backend/tests/test_edge_sandbox_mirrors_backend.py new file mode 100644 index 00000000..6f7783e4 --- /dev/null +++ b/backend/tests/test_edge_sandbox_mirrors_backend.py @@ -0,0 +1,29 @@ +"""The public edge vendors the desktop sandbox's static gate, and a gate that +only gets tightened on the desktop leaves the internet-facing copy open. So the +two files must stay byte-identical below their docstrings; SECURITY.md has +carried "drift risk" as an open note on this pair since the edge shipped. + +Run: + backend/.venv/bin/python -m pytest backend/tests/test_edge_sandbox_mirrors_backend.py -v +""" + +import ast +from pathlib import Path + +P_ROOT = Path(__file__).resolve().parents[2] +P_DESKTOP = P_ROOT / "backend" / "apps" / "outputs" / "code_safety.py" +P_EDGE = P_ROOT / "openswarm-edge" / "app" / "code_safety.py" + + +def p_body(path: Path) -> str: + """The file with its module docstring (the only licensed difference) removed.""" + source = path.read_text() + docstring = ast.parse(source).body[0] + return "".join(source.splitlines(keepends=True)[docstring.end_lineno:]) + + +def test_edge_gate_is_a_verbatim_copy_of_the_desktop_gate() -> None: + assert p_body(P_EDGE) == p_body(P_DESKTOP), ( + "openswarm-edge/app/code_safety.py has drifted from " + "backend/apps/outputs/code_safety.py; re-copy it below the docstring." + ) diff --git a/linter/config/config.json b/linter/config/config.json index 7e7ff818..2d5c9613 100644 --- a/linter/config/config.json +++ b/linter/config/config.json @@ -19,7 +19,7 @@ "eslint-knip": "Node tooling deferred to a later pass.", "classes": "Placeholder check, not wired up. endpoints: orphaned-endpoint triage deferred.", "max-file-lines-exceptions": "Grandfather list of pre-existing >300-line files (existing debt, not new). Paths updated after the folder-tree restructure moved several of them. The two manager/prompt/* entries are from the agent_manager decomposition: prompt_context.py aggregates the system-prompt context builders and attachments.py is one cohesive 230-line attachment resolver; both are single-responsibility and a few lines over, not splittable without an artificial seam.", - "max-folder-items-exceptions": "Exact-path allow for folders intentionally over the cap. The rule trips at >7 (7 items is fine, the 8th tips it), so only genuinely 8+ folders are listed. backend/ and backend/apps are FastAPI feature-package registries (each child is an app mounted in main.py); agents/ aggregates agent subsystems; agents/manager/ is the agent_manager god-object decomposition (cohesive AgentManager mixins + standalone run helpers + the streaming/permissions/prompt/session subtrees), conventionally flat like agents/ and core/ since its standalone helpers are heterogeneous and don't group cleanly; agents/manager/streaming and agents/manager/session are flat peer collections of one-module-per-concern handlers; core/, tools_lib/, tests/ are conventionally flat. Frontend: app/pages is the page registry, AgentChat/ChatInput/Settings-sections/Onboarding are organizational parents, and shared/state (Redux slices) plus hooks/steps/mcp-cards/Views are flat peer collections. scripts/, electron/, linter/checks/ are flat tool dirs. These replaced blanket .lintignore-max-folder-items sentinels (backend, frontend, scripts, electron, linter/checks) so the rule still catches NEW unplanned bloat everywhere else. Kept as whole-subtree sentinels on purpose: debugger/ (self-contained injected sub-tool with its own Vite GUI), webapp_template (Vite scaffold payload), and vendored mcp-bundles. 2026-07 desktop-shell additions: Dashboard canvas/cards/desktop + hooks/interaction + hooks/lifecycle, AgentChat bubbles/tool-ui, and shared/styles are flat peer collections (one component or hook per concern) that crossed 7 as the redesign surface grew. frontend/src/toolui carries a whole-subtree .lintignore: vendored tool-ui component library (pierre), same treatment as mcp-bundles.", + "max-folder-items-exceptions": "Exact-path allow for folders intentionally over the cap. The rule trips at >7 (7 items is fine, the 8th tips it), so only genuinely 8+ folders are listed. backend/ and backend/apps are FastAPI feature-package registries (each child is an app mounted in main.py); agents/ aggregates agent subsystems; agents/manager/ is the agent_manager god-object decomposition (cohesive AgentManager mixins + standalone run helpers + the streaming/permissions/prompt/session subtrees), conventionally flat like agents/ and core/ since its standalone helpers are heterogeneous and don't group cleanly; agents/manager/streaming and agents/manager/session are flat peer collections of one-module-per-concern handlers; core/, tools_lib/, tests/ are conventionally flat. Frontend: app/pages is the page registry, AgentChat/ChatInput/Settings-sections/Onboarding are organizational parents, and shared/state (Redux slices) plus hooks/steps/mcp-cards/Views are flat peer collections. scripts/, electron/, linter/checks/ are flat tool dirs. These replaced blanket .lintignore-max-folder-items sentinels (backend, frontend, scripts, electron, linter/checks) so the rule still catches NEW unplanned bloat everywhere else. Kept as whole-subtree sentinels on purpose: debugger/ (self-contained injected sub-tool with its own Vite GUI), webapp_template (Vite scaffold payload), and vendored mcp-bundles. 2026-07 desktop-shell additions: Dashboard canvas/cards/desktop + hooks/interaction + hooks/lifecycle, AgentChat bubbles/tool-ui, and shared/styles are flat peer collections (one component or hook per concern) that crossed 7 as the redesign surface grew. frontend/src/toolui carries a whole-subtree .lintignore: vendored tool-ui component library (pierre), same treatment as mcp-bundles. openswarm-edge/app is the edge's flat one-module-per-concern set (routing, bundles, inject, ratelimit, sandbox, and the vendored code_safety gate); it crossed 7 when the sandbox's static gate was split out to mirror the desktop file byte for byte.", "import-cycles": "Flags RUNTIME circular imports only (SCC>1). Skips type-only imports (import type / export type) and dynamic import() since neither runs at module init, which is why the idiomatic Redux store<->hooks type cycle is not flagged. Frontend alias resolution comes from import-cycle-aliases. Zero cycles today; the check keeps it that way.", "ruff + pyright": "Ported from Haik's linter (haik/feat/ingest). ruff is narrowed to F401/F811/F841 (unused imports/redefs/locals) and intentionally DROPS Haik's ARG001/ARG002 (unused args): our SDK-callback signatures require unused params (can_use_tool/pre_tool_hook take a `context` they don't use) and we ban the `_unused` prefix, so ARG is noise here. pyright runs Haik's existence-only config (typeCheckingMode off) with reportAttributeAccessIssue ENABLED: the AgentManager behavior classes now inherit a typing-only AgentManagerProtocol base (manager/AgentManagerProtocol.py) that declares the composed __init__ state + cross-class methods, so the checker sees self.sessions etc. from inside a mixin. pyright caught real bugs: a dangling `_conns` ref + TWO broken lazy imports (`_load_all`/`_load` from outputs.py, renamed to load_all/load in workspace_io but the import sites weren't updated \u2014 App Builder workspace seeding/name-sync was silently failing in a try/except). The one grandfathered SURFACE file (handle_assistant_message) is the SDK-optional try/except-import boundary (TextBlock=object fallback defeats isinstance narrowing). Both grandfather pre-existing debt by file; the refactor surface is clean. Requires `ruff` + `pyright` on PATH (added to requirements-dev.txt); pyright's config expects the venv at backend/.venv.", "no-underscore-names + p-private": "Convention checks ported verbatim from Haik's linter (haik/feat/ingest): no-underscore-names bans leading-underscore names (a dead-code-tooling blind spot; use p_ for private), p-private enforces that p_-prefixed names are accessed only inside their owning file/class (cross-file/class use means the name should be public). Backend Python only. The exception lists grandfather pre-existing debt that landed with the workflows/analytics forward-ports (eric's 'don't mass-migrate untouched files' rule); the agent_manager refactor surface is clean. NOTE: Haik's full linter (his branch also adds pyright + ruff and runs a different enabled set) should eventually supersede this; these two were lifted to enforce the p_ conventions on eric/dev now. browser_cookies.py is excepted for `_fields_` only: a ctypes.Structure protocol name required by the ctypes metaclass, not our naming." @@ -165,6 +165,7 @@ "backend/apps/agents/manager/session", "backend/apps/agents/manager/streaming", "backend/apps/outputs", + "openswarm-edge/app", "backend/apps/tools_lib", "backend/apps/service", "backend/tests", diff --git a/openswarm-edge/app/code_safety.py b/openswarm-edge/app/code_safety.py new file mode 100644 index 00000000..d05364ff --- /dev/null +++ b/openswarm-edge/app/code_safety.py @@ -0,0 +1,223 @@ +"""Static safety gate for published apps' backend.py compute. + +VENDORED, verbatim below this docstring, from backend/apps/outputs/code_safety.py +(the desktop App Builder gate). test_edge_sandbox_mirrors_backend.py in the +backend suite fails if the two drift, because a gate that is only tightened on +the desktop leaves the internet-facing copy open. +""" + +import ast +import importlib +import types +from typing import Dict, List, Optional, Set + +# Modules backend code is allowed to import. This is not an OS-level jail, so keep the list to "data shaping" libraries; no I/O, no networking, no subprocess. It pairs with cwd=tempdir + minimal env so the blast radius stays small. +ALLOWED_MODULES = frozenset({ + "json", "math", "re", "datetime", "collections", "itertools", + "functools", "statistics", "decimal", "fractions", "random", + "string", "textwrap", "unicodedata", "csv", "copy", "enum", + "dataclasses", "typing", "abc", "numbers", "uuid", "hashlib", + "base64", "binascii", "operator", "heapq", "bisect", "array", +}) + +# Builtins that punch holes through the allowlist or do I/O. Most are also deleted off `builtins` inside the subprocess; exec/compile/__import__ can't be, because the import machinery runs on them. +P_BLOCKED_BUILTINS = frozenset({ + "exec", "eval", "compile", "__import__", "open", "input", + "breakpoint", "exit", "quit", +}) + +# These hand back a live namespace dict, which is every blocked name again through a different door. Warned about but never deleted: library code calls them constantly, and a scrubbed `builtins` would break `import csv` itself. +P_NAMESPACE_BUILTINS = frozenset({"vars", "globals", "locals"}) + +# Spell an attribute as a string and the AST can't read it, so these are allowed only with a plain literal that would have passed written out longhand. +P_DYNAMIC_ATTR_BUILTINS = frozenset({"getattr", "setattr", "delattr"}) + +# Modules the executor preamble binds into the user's namespace with no import. `json` stays usable (it is allowlisted anyway); these three were the free handles that made the whole allowlist decorative. +P_SANDBOX_MODULE_HANDLES = frozenset({"sys", "io", "builtins"}) + +# Dunders that hold a reference to nothing at all, and `if __name__ == "__main__"` is far too common to punish. +P_INERT_DUNDERS = frozenset({"__name__", "__file__", "__doc__"}) + + +class UnsafeCodeError(Exception): + """Raised when the static gate rejects user-supplied backend code.""" + + +def p_is_dunder(name: str) -> bool: + return len(name) > 4 and name.startswith("__") and name.endswith("__") + + +def p_dotted_chain(node: ast.expr) -> Optional[List[str]]: + """['json', 'codecs', 'open'] for `json.codecs.open`; None when the chain + doesn't start at a plain name.""" + parts: List[str] = [] + current: ast.expr = node + while isinstance(current, ast.Attribute): + parts.append(current.attr) + current = current.value + if not isinstance(current, ast.Name): + return None + parts.append(current.id) + parts.reverse() + return parts + + +def p_resolved_module(chain: List[str], aliases: Dict[str, str]) -> Optional[str]: + """The name of the module an attribute chain resolves to, or None if it + resolves to something that isn't a module. + + `json.codecs` is a module and `datetime.time` is a class, and only the live + object knows which; matching attribute names against a list of module names + would flag both. So resolve against the module actually imported. Safe to + import here because `aliases` only ever holds allowlisted stdlib roots. + """ + root = aliases.get(chain[0]) + if root is None: + return None + try: + value: object = importlib.import_module(root) + for attr in chain[1:]: + value = getattr(value, attr) + except Exception: + return None + return value.__name__ if isinstance(value, types.ModuleType) else None + + +def p_module_aliases(tree: ast.Module) -> Dict[str, str]: + """Local name -> allowlisted module it holds. Plain assignment counts, so + `m = json` doesn't launder `m.codecs` past the chain check. Modules outside + the allowlist are never recorded, which is what keeps the resolver above + from importing anything a hostile file names.""" + aliases: Dict[str, str] = {"json": "json"} + for node in ast.walk(tree): + if isinstance(node, ast.Import): + for alias in node.names: + root = alias.name.split(".")[0] + if root in ALLOWED_MODULES: + aliases[alias.asname or root] = root + assigns = [n for n in ast.walk(tree) if isinstance(n, ast.Assign)] + for _ in range(len(assigns)): + before = len(aliases) + for node in assigns: + if len(node.targets) != 1 or not isinstance(node.targets[0], ast.Name): + continue + chain = p_dotted_chain(node.value) + resolved = p_resolved_module(chain, aliases) if chain else None + if resolved and resolved.split(".")[0] in ALLOWED_MODULES: + aliases[node.targets[0].id] = resolved + if len(aliases) == before: + break + return aliases + + +def p_dunder_warning(attr: str, prefix: str) -> Optional[str]: + if p_is_dunder(attr) and attr not in P_INERT_DUNDERS: + return f"Uses dunder '{prefix}{attr}', which walks the object graph past the allowlist" + return None + + +def p_attribute_warning(chain: List[str], aliases: Dict[str, str]) -> Optional[str]: + """The verdict on one resolved attribute chain, dunders first.""" + for attr in chain[1:]: + dunder = p_dunder_warning(attr, ".") + if dunder: + return dunder + for depth in range(2, len(chain) + 1): + reached = p_resolved_module(chain[:depth], aliases) + if reached and reached.split(".")[0] not in ALLOWED_MODULES: + return f"Reaches module '{reached}' via '{'.'.join(chain[:depth])}' (outside the safe-data-shaping allowlist)" + return None + + +def p_call_warning(node: ast.Call, aliases: Dict[str, str]) -> Optional[str]: + if not isinstance(node.func, ast.Name): + return None + name = node.func.id + if name in P_BLOCKED_BUILTINS: + return f"Calls builtin '{name}()' which can escape the sandbox" + if name in P_NAMESPACE_BUILTINS: + return f"Calls '{name}()', which hands back the sandbox's own namespace" + if name not in P_DYNAMIC_ATTR_BUILTINS: + return None + attr = node.args[1] if len(node.args) > 1 else None + if not isinstance(attr, ast.Constant) or not isinstance(attr.value, str): + return f"Computes an attribute name for '{name}()', which can spell any escape as a string" + base = p_dotted_chain(node.args[0]) + if base is None: + return p_dunder_warning(attr.value, ".") + return p_attribute_warning(base + [attr.value], aliases) + + +def p_star_import_warning(module: str, aliases: Dict[str, str]) -> Optional[str]: + """`from json import *` binds whatever json's __all__ names, which is a + short list of functions today but is not ours to assume.""" + try: + imported = importlib.import_module(module) + except Exception: + return None + names = getattr(imported, "__all__", None) or [n for n in dir(imported) if not n.startswith("_")] + for name in names: + warning = p_attribute_warning([module, str(name)], aliases) + if warning: + return warning + return None + + +def get_code_warnings(code: str) -> List[str]: + """Return human-readable warnings for every static risk, without raising. + + `/api/outputs/execute` surfaces these in the run dialog, so an Output that + genuinely needs `pandas` gets a "review and click Run Anyway" affordance + instead of a silent 500. An empty list is what buys the no-prompt auto-run + path, so anything that could reach past the allowlist has to land in it. A + syntax error is reported as a warning rather than raised, so the dialog can + show it next to the code. + """ + try: + tree = ast.parse(code) + except SyntaxError as e: + return [f"Syntax error: {e}"] + + aliases = p_module_aliases(tree) + warnings: List[str] = [] + seen: Set[str] = set() + + def note(msg: Optional[str]) -> None: + if msg and msg not in seen: + seen.add(msg) + warnings.append(msg) + + for node in ast.walk(tree): + if isinstance(node, ast.Import): + for alias in node.names: + if alias.name.split(".")[0] not in ALLOWED_MODULES: + note(f"Imports '{alias.name}' (outside the safe-data-shaping allowlist)") + elif isinstance(node, ast.ImportFrom): + root = (node.module or "").split(".")[0] + if root not in ALLOWED_MODULES: + note(f"Imports from '{node.module}' (outside the safe-data-shaping allowlist)") + continue + for alias in node.names: + if alias.name == "*": + note(p_star_import_warning(root, aliases)) + else: + note(p_attribute_warning([root, alias.name], aliases)) + elif isinstance(node, ast.Call): + note(p_call_warning(node, aliases)) + elif isinstance(node, ast.Attribute): + chain = p_dotted_chain(node) + note(p_attribute_warning(chain, aliases) if chain else p_dunder_warning(node.attr, ".")) + elif isinstance(node, ast.Name): + if node.id in P_SANDBOX_MODULE_HANDLES: + note(f"References '{node.id}', a live module the sandbox binds but the allowlist withholds") + else: + note(p_dunder_warning(node.id, "")) + return warnings + + +def validate_code_safety(code: str) -> None: + """Raise UnsafeCodeError on the first static risk. The strict wrapper around + get_code_warnings, for callers with no user to ask.""" + warnings = get_code_warnings(code) + if warnings: + raise UnsafeCodeError(warnings[0]) diff --git a/openswarm-edge/app/main.py b/openswarm-edge/app/main.py index 1c0cecd2..fa819cf3 100644 --- a/openswarm-edge/app/main.py +++ b/openswarm-edge/app/main.py @@ -20,7 +20,8 @@ from .bundles import get_bundle, resolve_file from .fallback import apex_page, not_found_page from .inject import inject_runtime from .ratelimit import RateLimiter -from .sandbox import UnsafeCodeError, run_backend +from .code_safety import UnsafeCodeError +from .sandbox import run_backend APPS_BASE_DOMAIN = os.environ.get("APPS_BASE_DOMAIN", "openswarm.host") # The metered-LLM call goes to the cloud over Fly's PRIVATE 6PN mesh (encrypted, diff --git a/openswarm-edge/app/sandbox.py b/openswarm-edge/app/sandbox.py index c7a0947e..585c6830 100644 --- a/openswarm-edge/app/sandbox.py +++ b/openswarm-edge/app/sandbox.py @@ -1,13 +1,13 @@ """Sandboxed Python runner for published apps' backend.py compute. VENDORED from backend/apps/outputs/executor.py (the desktop App Builder runtime). -Keep the allow/deny lists + the subprocess hardening in sync with that file; this -is the same data-shaping sandbox, just running in the edge instead of on the -desktop. Pure compute only: no network, no disk, no subprocess, no secrets. Safe -to run multi-tenant on one machine because nothing here can reach shared state.""" +Keep the subprocess hardening in sync with that file; this is the same +data-shaping sandbox, just running in the edge instead of on the desktop. The +static gate it runs on every call lives in the vendored app/code_safety.py. Pure +compute only: no network, no disk, no subprocess, no secrets. Safe to run +multi-tenant on one machine because nothing here can reach shared state.""" from __future__ import annotations -import ast import asyncio import json import os @@ -15,46 +15,10 @@ import sys import tempfile from dataclasses import dataclass +from app.code_safety import ALLOWED_MODULES, validate_code_safety + TIMEOUT_SECONDS = 30 -_ALLOWED_MODULES = frozenset({ - "json", "math", "re", "datetime", "collections", "itertools", - "functools", "statistics", "decimal", "fractions", "random", - "string", "textwrap", "unicodedata", "csv", "copy", "enum", - "dataclasses", "typing", "abc", "numbers", "uuid", "hashlib", - "base64", "binascii", "operator", "heapq", "bisect", "array", -}) - -_BLOCKED_BUILTINS = frozenset({ - "exec", "eval", "compile", "__import__", "open", "input", - "breakpoint", "exit", "quit", -}) - - -class UnsafeCodeError(Exception): - """AST validation rejected the backend code.""" - - -def validate_code_safety(code: str) -> None: - """Raise UnsafeCodeError on the first AST-visible risk. Published apps are - vetted at publish time, but we re-check here: the edge never trusts that the - bundle in storage matches what was scanned.""" - try: - tree = ast.parse(code) - except SyntaxError as e: - raise UnsafeCodeError(f"Syntax error: {e}") - for node in ast.walk(tree): - if isinstance(node, ast.Import): - for alias in node.names: - if alias.name.split(".")[0] not in _ALLOWED_MODULES: - raise UnsafeCodeError(f"import '{alias.name}' is not allowed") - elif isinstance(node, ast.ImportFrom): - if node.module and node.module.split(".")[0] not in _ALLOWED_MODULES: - raise UnsafeCodeError(f"import from '{node.module}' is not allowed") - elif isinstance(node, ast.Call): - if isinstance(node.func, ast.Name) and node.func.id in _BLOCKED_BUILTINS: - raise UnsafeCodeError(f"builtin '{node.func.id}()' is not allowed") - def _minimal_env() -> dict: return { @@ -79,19 +43,22 @@ async def run_backend(code: str, input_data: dict) -> ComputeResult: preamble = ( "import json, sys, io, builtins\n" - "for _b in ('exec','eval','compile','open','input',\n" - " 'breakpoint','exit','quit'):\n" - " try: delattr(builtins, _b)\n" - " except AttributeError: pass\n" - "_orig_stdout = sys.stdout\n" - "_capture = io.StringIO()\n" - "sys.stdout = _capture\n" + "p_stdout = sys.stdout\n" + "p_capture = io.StringIO()\n" + "sys.stdout = p_capture\n" "input_data = json.loads(sys.stdin.read())\n" "result = {}\n" + # Warm the allowlist BEFORE scrubbing builtins: half the stdlib borrows the builtins the scrub deletes while it loads (tokenize does `from builtins import open`, taking `import dataclasses` with it). Then the module handles go, because leaving `sys` bound hands gate-passing code a live `sys.modules['os']` with no import statement in sight. + f"for p_name in {tuple(sorted(ALLOWED_MODULES))!r}:\n" + " try: __import__(p_name)\n" + " except ImportError: pass\n" + "for p_name in ('open','input','breakpoint','exit','quit'):\n" + " try: delattr(builtins, p_name)\n" + " except AttributeError: pass\n" + "del sys, io, builtins, p_name\n" ) postamble = ( - "\nsys.stdout = _orig_stdout\n" - 'json.dump({"__stdout__": _capture.getvalue(), "__result__": result}, sys.stdout)\n' + "\np_stdout.write(json.dumps({\"__stdout__\": p_capture.getvalue(), \"__result__\": result}))\n" ) wrapper = preamble + code + postamble diff --git a/openswarm-edge/tests/test_edge.py b/openswarm-edge/tests/test_edge.py index 8d05a695..6d5a6f1a 100644 --- a/openswarm-edge/tests/test_edge.py +++ b/openswarm-edge/tests/test_edge.py @@ -21,7 +21,9 @@ from app.main import slug_from_host from app.bundles import unpack, resolve_file from app.inject import inject_runtime from app.ratelimit import RateLimiter -from app.sandbox import validate_code_safety, run_backend, UnsafeCodeError +from app.code_safety import validate_code_safety, UnsafeCodeError +from app import sandbox as edge_sandbox +from app.sandbox import run_backend def test_slug_from_host(): @@ -179,11 +181,51 @@ def test_sandbox_rejects_unsafe_and_allows_safe(): validate_code_safety("import math\nresult={'x': math.pi}") # no raise +def test_sandbox_rejects_the_module_handle_escapes(): + """Issue #134 at the public tier: the preamble's own `sys`/`io` handles, an + attribute chain onto a withheld module, and the dunder walk.""" + for code in ( + "result = {'cwd': sys.modules['os'].getcwd()}", + "result = {'x': str(io.open)}", + "result = {'c': str(json.codecs)}", + "result = {'n': len(().__class__.__bases__[0].__subclasses__())}", + "result = {'c': str(getattr(json, 'codecs'))}", + ): + try: + validate_code_safety(code) + assert False, f"expected UnsafeCodeError for {code!r}" + except UnsafeCodeError: + pass + + def test_sandbox_runs_safe_code(): res = asyncio.run(run_backend("result = {'sum': sum(input_data['nums'])}", {"nums": [1, 2, 3]})) assert res.result == {"sum": 6} +def test_sandbox_runs_allowlisted_imports(): + """The builtins scrub used to delete exec/eval, which broke `import statistics` + and every namedtuple; a sandbox that can't run real code isn't secure, it's off.""" + res = asyncio.run(run_backend( + "import statistics, datetime\n" + "result = {'mean': statistics.mean(input_data['nums']), 'd': datetime.time(9, 0).isoformat()}", + {"nums": [1, 2, 3]}, + )) + assert res.result == {"mean": 2, "d": "09:00:00"} + + +def test_sandbox_subprocess_has_no_module_handles(monkeypatch): + """Second wall: pretend a payload beats the gate, and the subprocess still + has no module left to grab.""" + monkeypatch.setattr(edge_sandbox, "validate_code_safety", lambda code: None) + for handle in ("sys", "io", "builtins"): + try: + asyncio.run(run_backend(f"result = {{'x': str({handle})}}", {})) + assert False, f"{handle} was still reachable" + except RuntimeError as e: + assert "NameError" in str(e) + + def test_inject_runtime(): out = inject_runtime(b"xhi").decode() assert "OUTPUT_COMPUTE" in out and "OUTPUT_LLM" in out