Ë
    ÜûÝj}Q  ã                   óf  — d Z ddlZddlZddlZddlmZ ddlmZmZ ddl	m
Z
 ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZmZ g d¢ZddddddddddeddgZd$d„Z G d„ dej2                  «      Z G d„ de«      Z G d„ de«      Z G d„ d e«      Z G d!„ d"e«      Zed#k(  r ej@                  «        yy)%a¨  E44 Option 2 (Kais TG 12923, 25.10.2026): codex.tools_write_allowlist.

Validierung (Funktion, Konfiguration, Runner, Profilbau) und Regelaufbau des tools-Profils: das Home ist
nur noch LESBAR, geschrieben wird nur in den ephemeren Lauf-Verzeichnissen und in ausdruecklich
freigegebenen Projektordnern. Synthetischer Home-Baum, kein Kaefig-Start (echte Landlock-Laeufe stehen in
test_isolation_tools.WriteAllowlistRealHome).é    N)ÚPath)ÚConfigurationErrorÚparse_gateway_config)ÚGateway)ÚISO_EXEC_PATH)Úprofiles)ÚCagedCodexRunner)ÚRunSpec)Úconfig_dictÚ	write_key)z/usr/bin/codexÚexecz-szdanger-full-accessú-z/usr/bin/systemd-runz--userz--scopez--quietz--unitz{unit}ú/usr/bin/envú-iz/usr/bin/python3z-Iz{cfg}ú--c                 óÔ   — t        j                  t         j                  j                  | «      d¬«       t	        | dd¬«      5 }|j                  |«       d d d «       y # 1 sw Y   y xY w)NT©Úexist_okÚwzutf-8)Úencoding)ÚosÚmakedirsÚpathÚdirnameÚopenÚwrite)r   ÚbodyÚfhs      ú;/home/aria/aria-v3-dev/python/tests/test_write_allowlist.pyÚtouchr       sK   € Ü‡K�K”—‘—‘ Ó%°Õ5Ü	ˆd�C 'Ô	*ð ¨bØ
�‰�Œ÷÷ ñ ús   ÁAÁA'c                   ó"   — e Zd ZdZd„ Zd„ Zd„ Zy)ÚSyntheticHomeBasez¸Home-Baum mit Projektordnern, einem kostenwache-Muster (melde.sh = Cron-Ziel, kostenwache.py
    daneben), Startschutz-Bereichen, Caches, Credentials, einer aria-v3-Kopie und Symlinks.c                 óÒ  — t        j                  «       | _        | j                  j                  | _        t
        j                  j                  | j                  d«      | _        i dd“dd“dd“dd	“d
d“dd“dd“dd“dd“dd“dd	“dd	“dd“dd“dd“dd“d d!“d!d"dd#œ¥j                  «       D ]9  \  }}t        t
        j                  j                  | j                  |«      |«       Œ; t        j                  t
        j                  j                  | j                  d$«      t
        j                  j                  | j                  d%«      «       t        j                  t
        j                  j                  | j                  d&«      t
        j                  j                  | j                  d'«      «       t
        j                  j                  | j                  d$d(«      | _        t
        j                  j                  | j                  d$d)«      | _        t
        j                  j                  | j                  d$d*«      | _        d+| j                  z  d,| j                  z  g| _        y )-NÚhomeúprojekte/app/main.pyzprint('app')
zprojekte/app/src/util.pyzx = 1
úprojekte/app/.envz	SECRET=1
ú"projekte/app/.git/hooks/pre-commitz
#!/bin/sh
úprojekte/app/.git/configz[core]
ú!projekte/aws-kostenwache/melde.shz!#!/bin/sh
python3 kostenwache.py
ú'projekte/aws-kostenwache/kostenwache.pyzprint('kosten')
úprojekte/cronproj/run.pyzprint('cron')
zprojekte/runs/keep.txtÚxúbrain/note.mdÚnzscripts/wrapper.shzscripts/sub/x.shzstate/run-heartbeat.confzCONF=1
zgwstate/sub/budget.jsonú{}ú.cache/pip/wheel.whlr   ú.cargo/registry/src/lib.rsz	fn x(){}
z	.ssh/id_xÚKEYÚcopy)zkeystore/keyzaria-v3-copy/x.pyú	notes.txtÚprojekteÚlinkÚscriptsÚaliasÚappzaws-kostenwacheÚcronprojz(*/10 * * * * %s/melde.sh >/dev/null 2>&1z#*/5 * * * * cd %s && python3 run.py)ÚtempfileÚTemporaryDirectoryÚ_tmpÚnameÚbaser   r   ÚjoinÚHÚitemsr    Úsymlinkr9   Úkostenr:   Úcron)ÚselfÚrelr   s      r   ÚsetUpzSyntheticHomeBase.setUp#   s9  € Ü×/Ñ/Ó1ˆŒ	Ø—I‘I—N‘NˆŒ	Ü—‘—‘˜dŸi™i¨Ó0ˆŒð
Ø"Ð$4ð
à&¨	ð
ð   ð
ð 1°-ð	
ð
 '¨
ð
ð 0Ð1Vð
ð 6Ð7Jð
ð 'Ð(9ð
ð % cð
ð ˜Sð
ð #7¸ð
ð HZÐ[hð
ð '¨
ð
ð 5NÈtð
ð # Cð
ð *FÀ|ð
ð ˜ð
ð 16ÈFØò
÷ ‰%‹'ò	3‰IˆC�ô  ”"—'‘'—,‘,˜tŸv™v sÓ+¨TÕ2ð!	3ô" 	�
‰
”2—7‘7—<‘< §¡¨
Ó3´R·W±W·\±\À$Ç&Á&È&Ó5QÔRÜ
�
‰
”2—7‘7—<‘< §¡¨	Ó2´B·G±G·L±LÀÇÁÈÓ4QÔRÜ—7‘7—<‘< §¡¨
°EÓ:ˆŒÜ—g‘g—l‘l 4§6¡6¨:Ð7HÓIˆŒÜŸ™Ÿ™ T§V¡V¨Z¸ÓDˆŒØ?À$Ç+Á+ÑMØ:¸T¿]¹]ÑJðLˆ�	ó    c                 ó8   — | j                   j                  «        y ©N)r=   Úcleanup©rF   s    r   ÚtearDownzSyntheticHomeBase.tearDown@   s   € Ø�	‰	×ÑÕrI   c                 óV   — t         j                  j                  | j                  |«      S rK   )r   r   r@   rA   ©rF   rG   s     r   ÚpzSyntheticHomeBase.pC   s   € Ü�w‰w�|‰|˜DŸF™F CÓ(Ð(rI   N)Ú__name__Ú
__module__Ú__qualname__Ú__doc__rH   rN   rQ   © rI   r   r"   r"      s   „ ñ_òLò:ó)rI   r"   c                   ól   — e Zd Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ Z	d„ Z
d	„ Zd
„ Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ Zy)ÚValidateWriteAllowlistc                 óf   — |j                  d| j                  «       t        j                  |fi |¤ŽS )NÚ	home_root)Ú
setdefaultrA   ÚPÚvalidate_write_allowlist)rF   ÚentriesÚkws      r   ÚvzValidateWriteAllowlist.vH   s*   € Ø
�‰�k 4§6¡6Ô*Ü×)Ñ)¨'Ñ8°RÑ8Ð8rI   c                 óà   — | j                  t        j                  «      5 } | j                  |gfi |¤Ž d d d «       | j	                  |t        j                  «      |«       y # 1 sw Y   Œ0xY wrK   )ÚassertRaisesr\   ÚWriteAllowlistErrorr`   ÚassertInÚstrÚ	exception)rF   ÚentryÚneedler_   Úcs        r   ÚrejectedzValidateWriteAllowlist.rejectedL   s[   € Ø×Ñœq×4Ñ4Ó5ð 	"¸ØˆD�F‰F�E�7Ñ!˜bÒ!÷	"à�‰�fœc !§+¡+Ó.°Õ6÷	"ð 	"ús    A$Á$A-c                 óˆ   — | j                  | j                  g «      d«       | j                  | j                  d«      d«       y ©NrV   )ÚassertEqualr`   rM   s    r   Útest_default_empty_is_validz2ValidateWriteAllowlist.test_default_empty_is_validQ   s2   € Ø×Ñ˜Ÿ™ › RÔ(Ø×Ñ˜Ÿ™ › RÕ(rI   c                 ó´   — | j                  | j                  | j                  | j                  | j                  g«      | j                  | j                  f«       y rK   )rm   r`   r9   rD   rM   s    r   Ú1test_valid_project_dirs_accepted_and_deduplicatedzHValidateWriteAllowlist.test_valid_project_dirs_accepted_and_deduplicatedU   s;   € Ø×Ñ˜Ÿ™ §¡¨4¯;©;¸¿¹Ð AÓBÀTÇXÁXÈtÏ{É{ÐD[Õ\rI   c                 óÔ   — | j                  d«      }| j                  d«      }| j                  | j                  | j                  d«      g|h|h¬«      | j                  d«      f«       y )Nr&   zprojekte/app/.git/hooksr5   )ÚblockedÚ	read_only)rQ   rm   r`   )rF   ÚsecretÚhookss      r   Ú)test_ancestor_of_blocked_paths_is_allowedz@ValidateWriteAllowlist.test_ancestor_of_blocked_paths_is_allowedX   s`   € à—‘Ð+Ó,ˆØ—‘Ð0Ó1ˆØ×Ñ˜Ÿ™ §¡¨
Ó!3Ð 4¸v¸hÐSXÐRY˜ÓZØŸ&™& Ó,Ð.õ	0rI   c                 ó`  — | j                   d dddifD ];  }| j                  t        j                  «      5  | j	                  |«       d d d «       Œ= dgdgdgfD ];  }| j                  t        j                  «      5  | j	                  |«       d d d «       Œ= y # 1 sw Y   ŒŽxY w# 1 sw Y   ŒTxY w)Né   r,   é   Ú za b)r9   rb   r\   rc   r`   ©rF   Úbads     r   Útest_rejects_wrong_typesz/ValidateWriteAllowlist.test_rejects_wrong_types_   s²   € Ø—H‘H˜d A¨¨Q xÐ0ò 	ˆCØ×"Ñ"¤1×#8Ñ#8Ó9ñ Ø—‘�s”÷ð ð	ð �D˜1˜# ˜zÐ*ò 	ˆCØ×"Ñ"¤1×#8Ñ#8Ó9ñ Ø—‘�s”÷ð ñ	÷ð ú÷ð ús   µBÁ;B$ÂB!	Â$B-	c                 ó(  — | j                  dd«       | j                  | j                  dz   d«       | j                  | j                  d«      d«       | j                  | j                  dz   d«       | j                  | j                  d«      d«       y )Núprojekte/appÚabsoluteú/Ú	canonicalzprojekte/../projekte/appz//projekte/appzprojekte/./app)rj   r9   rQ   rA   rM   s    r   Ú'test_rejects_relative_and_non_canonicalz>ValidateWriteAllowlist.test_rejects_relative_and_non_canonicalg   sn   € Ø�‰�n jÔ1Ø�‰�d—h‘h ‘n kÔ2Ø�‰�d—f‘fÐ7Ó8¸+ÔFØ�‰�d—f‘fÐ/Ñ/°Ô=Ø�‰�d—f‘fÐ-Ó.°Õ<rI   c                 ó¼   — | j                  | j                  d«       | j                  | j                  d«       | j                  dd«       | j                  dd«       y )Núhome_root itselfúbelow home_rootú/tmpú/etc)rj   rA   r?   rM   s    r   Ú"test_rejects_home_root_and_outsidez9ValidateWriteAllowlist.test_rejects_home_root_and_outsiden   sF   € Ø�‰�d—f‘fÐ0Ô1Ø�‰�d—i‘iÐ!2Ô3Ø�‰�fÐ/Ô0Ø�‰�fÐ/Õ0rI   c                 óT   — dD ]#  }| j                  | j                  |«      d«       Œ% y )N)ú.cachez
.cache/pipz.cargo/registryúprojekte/app/.gitú.sshÚhidden©rj   rQ   rP   s     r   Útest_rejects_hidden_componentsz5ValidateWriteAllowlist.test_rejects_hidden_componentst   s*   € ð \ò 	1ˆCØ�M‰M˜$Ÿ&™& ›+ xÕ0ñ	1rI   c                 ó  — | j                  | j                  d«      d«       | j                  | j                  d«      d«       | j                  | j                  d«      d«       | j                  | j                  d«      d«       y )	Núprojekte/fehltúdoes not existr4   zdirectory expectedr6   zsymlink rejectedúlink/appúpath contains a symlinkr�   rM   s    r   Ú&test_rejects_missing_file_and_symlinksz=ValidateWriteAllowlist.test_rejects_missing_file_and_symlinksz   sb   € Ø�‰�d—f‘fÐ-Ó.Ð0@ÔAØ�‰�d—f‘f˜[Ó)Ð+?Ô@Ø�‰�d—f‘f˜V“nÐ&8Ô9Ø�‰�d—f‘f˜ZÓ(Ð*CÕDrI   c                 óÀ   — | j                  t        j                  j                  | j	                  d«      «      «       | j                  | j	                  d«      d«       y )Nz	alias/subr•   )Ú
assertTruer   r   ÚisdirrQ   rj   rM   s    r   Ú5test_symlinked_ancestor_cannot_smuggle_protected_areazLValidateWriteAllowlist.test_symlinked_ancestor_cannot_smuggle_protected_area€   s>   € ð 	�‰œŸ™Ÿ™ d§f¡f¨[Ó&9Ó:Ô;Ø�‰�d—f‘f˜[Ó)Ð+DÕErI   c                 óT   — dD ]#  }| j                  | j                  |«      d«       Œ% y )N)Úbrainr7   zscripts/subÚstateúinside blocked arear�   rP   s     r   Ú#test_rejects_startup_protected_dirsz:ValidateWriteAllowlist.test_rejects_startup_protected_dirs†   s(   € Ø?ò 	>ˆCØ�M‰M˜$Ÿ&™& ›+Ð'<Õ=ñ	>rI   c                 ón  — | j                  | j                  d«      d| j                  d«      ¬«       | j                  | j                  d«      d| j                  d«      ¬«       | j                  | j                  d| j                  ¬«       ddlm} | j                  | j                  d«      d|¬«       y )	NÚgwstaterž   ©Ú	state_dirúgwstate/sub)Ú	repo_rootr   )ÚPKG_REPO_ROOTzaria-v3-copy)rj   rQ   r9   Úaria_router.isolationr¦   )rF   r¦   s     r   Ú&test_rejects_state_dir_repo_and_familyz=ValidateWriteAllowlist.test_rejects_state_dir_repo_and_familyŠ   sˆ   € Ø�‰�d—f‘f˜YÓ'Ð)>È$Ï&É&ÐQZÓJ[ˆÔ\Ø�‰�d—f‘f˜]Ó+Ð-BÈdÏfÉfÐU^ÓN_ˆÔ`Ø�‰�d—h‘hÐ 5ÀÇÁˆÔJå7Ø�‰�d—f‘f˜^Ó,Ð.CÈ}ˆÕ]rI   c                 óö   — dd l }|j                  | j                  d«      «       t        j                  | j                  d«      | j                  d«      «       | j                  | j                  d«      d«       y )Nr   r�   Úkeystorerž   )ÚshutilÚrmtreerQ   r   rC   rj   )rF   r«   s     r   Ú&test_rejects_credential_symlink_targetz=ValidateWriteAllowlist.test_rejects_credential_symlink_target’   sP   € ãØ�‰�d—f‘f˜V“nÔ%Ü
�
‰
�4—6‘6˜*Ó% t§v¡v¨f£~Ô6Ø�‰�d—f‘f˜ZÓ(Ð*?Õ@rI   c                 ó  — | j                  | j                  d| j                  h¬«       | j                  | j                  d| j                  h¬«       | j                  | j                  d«      d| j                  d«      h¬«       y )Nrž   )rr   zinside read-only protected area)rs   r   r5   )rj   r9   r:   rQ   rM   s    r   Ú*test_rejects_dynamic_blocked_and_read_onlyzAValidateWriteAllowlist.test_rejects_dynamic_blocked_and_read_only™   sl   € à�‰�d—h‘hÐ 5ÀÇÁ¸zˆÔJØ�‰�d—m‘mÐ%FÐSW×S`ÑS`ÐRaˆÔbØ�‰�d—f‘f˜^Ó,Ð.OÐ\`×\bÑ\bÐcmÓ\nÐ[oˆÕprI   c                 ó~  — | j                  d«      }| j                  d«      |fD ]  }| j                  |d|¬«       Œ t        j                  | j                  d«      «       | j                  | j                  d«      d|¬«       | j	                  | j                  | j                  g|¬«      | j                  f«       y )Núprojekte/runsr5   úrun container)Ú	runs_rootzprojekte/runs/codexrun-x)rQ   rj   r   r   rm   r`   r9   )rF   Úrunsrg   s      r   Ú'test_rejects_overlap_with_run_containerz>ValidateWriteAllowlist.test_rejects_overlap_with_run_containerŸ   s�   € Ø�v‰v�oÓ&ˆØ—f‘f˜ZÓ(¨$Ð/ò 	BˆEØ�M‰M˜% ¸DˆMÕAð	Bä
�‰�D—F‘FÐ5Ó6Ô7Ø�‰�d—f‘fÐ7Ó8¸/ÐUYˆÔZØ×Ñ˜Ÿ™ §¡ 
°d˜Ó;¸d¿h¹h¸[ÕIrI   N)rR   rS   rT   r`   rj   rn   rp   rv   r}   rƒ   r‰   r�   r–   rš   rŸ   r¨   r­   r¯   rµ   rV   rI   r   rX   rX   G   sY   „ ò9ò7ò
)ò]ò0òò=ò1ò1òEòFò>ò^òAòqóJrI   rX   c                   óH   — e Zd Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ Z	d„ Z
d	„ Zd
„ Zy)ÚConfigWriteAllowlistc                 ó|   — t        t        | j                  «      d|i«      }|j                  |«       t	        |«      S )NÚcodex)r   r   r?   Úupdater   )rF   r¹   ÚtopÚdatas       r   ÚparsezConfigWriteAllowlist.parse©   s2   € Üœ4 §	¡	›?¨W°eÐ,<Ó=ˆØ�‰�CÔÜ# DÓ)Ð)rI   c                 ó8   — dt         t        | j                  dœ|¥S )NÚtools)ÚprofileÚcommand_templateÚisolation_wrapperrZ   )ÚDANGERÚCAGErA   )rF   Úextras     r   r¿   zConfigWriteAllowlist.tools®   s#   € Ø"¼ÔUYØ!ŸV™Vñ.Ø',ð.ð 	.rI   c                 óô   — | j                  | j                  | j                  «       «      j                  j                  d«       | j                  | j                  i «      j                  j                  d«       y rl   )rm   r½   r¿   r¹   Útools_write_allowlistrM   s    r   Útest_default_is_emptyz*ConfigWriteAllowlist.test_default_is_empty²   sQ   € Ø×Ñ˜Ÿ™ D§J¡J£LÓ1×7Ñ7×MÑMÈrÔRØ×Ñ˜Ÿ™ B›×-Ñ-×CÑCÀRÕHrI   c                 óê   — | j                  | j                  | j                  | j                  g¬«      «      }| j	                  |j
                  j                  | j                  | j                  f«       y )N©rÇ   )r½   r¿   r9   rD   rm   r¹   rÇ   ©rF   Úcfgs     r   Útest_valid_allowlist_parsedz0ConfigWriteAllowlist.test_valid_allowlist_parsed¶   sO   € Ø�j‰j˜Ÿ™¸4¿8¹8ÀTÇ[Á[Ð:Q˜ÓRÓSˆØ×Ñ˜Ÿ™×8Ñ8¸4¿8¹8ÀTÇ[Á[Ð:QÕRrI   c                 ó:  — | j                  d«      df| j                  df| j                  d«      df| j                  dz   df| j                  d«      d	fd
fD ]ª  \  }}| j                  |¬«      5  | j	                  t
        «      5 }| j                  | j                  |g¬«      «       d d d «       | j                  dt        j                  «      «       | j                  |t        |j                  «      «       d d d «       Œ¬ y # 1 sw Y   Œ^xY w# 1 sw Y   ŒÃxY w)Nr‹   rŽ   r…   rœ   rž   r�   r‚   r’   r“   )rˆ   r†   ©rg   rÊ   zcodex.tools_write_allowlist)rQ   rA   r9   ÚsubTestrb   r   r½   r¿   rd   re   rf   )rF   rg   rh   ri   s       r   Ú0test_invalid_entry_fails_closed_with_clear_errorzEConfigWriteAllowlist.test_invalid_entry_fails_closed_with_clear_errorº   s	  € Ø#Ÿv™v hÓ/°Ð:¸T¿V¹VÐEWÐ<XØ#Ÿv™v g›Ð0EÐFÈÏÉÐTWÉÐYdÐHeØ#Ÿv™vÐ&6Ó7Ð9IÐJÐLgðiò 	8‰MˆE�6ð —‘ E�Ó*ñ 8Ø×&Ñ&Ô'9Ó:ð J¸aØ—J‘J˜tŸz™zÀÀ˜zÓHÔI÷Jà—‘Ð;¼SÀÇÁÓ=MÔNØ—‘˜f¤c¨!¯+©+Ó&6Ô7÷	8ð 8ñ	8÷Jð Jú÷8ð 8ús%   Á/DÂ#DÂ(ADÄDÄ
DÄD	c                 ó&  — | j                  t        «      5 }| j                  | j                  | j	                  d«      g¬«      | j	                  d«      ¬«       d d d «       | j                  dt        j                  «      «       y # 1 sw Y   Œ/xY w)Nr¤   rÊ   r¡   r¢   rž   ©rb   r   r½   r¿   rQ   rd   re   rf   ©rF   ri   s     r   Útest_inside_state_dir_rejectedz3ConfigWriteAllowlist.test_inside_state_dir_rejectedÄ   sx   € Ø×ÑÔ1Ó2ð 	o°aØ�J‰J�t—z‘z¸¿¹ÀÓ9NÐ8O�zÓPÐ\`×\bÑ\bÐclÓ\mˆJÔn÷	oà�‰Ð+¬S°·±Ó-=Õ>÷	oð 	oús   –ABÂBc           	      ó$  — | j                  t        «      5 }| j                  | j                  | j	                  d«      g| j	                  d«      ¬«      «       d d d «       | j                  dt        j                  «      «       y # 1 sw Y   Œ/xY w)Nr5   r±   )rÇ   Úworkspace_rootr²   rÓ   rÔ   s     r   Ú)test_overlap_with_workspace_root_rejectedz>ConfigWriteAllowlist.test_overlap_with_workspace_root_rejectedÉ   s}   € Ø×ÑÔ1Ó2ð 	K°aØ�J‰J�t—z‘z¸¿¹À
Ó9KÐ8LØ15·±¸Ó1Hð "ó Jô K÷	Kð 	�‰�o¤s¨1¯;©;Ó'7Õ8÷	Kð 	Kús   –ABÂBc                 óx  — | j                  t        «      5 }| j                  | j                  | j                  gdœ«       d d d «       | j                  dt        j                  «      «       | j                  | j                  | j                  g dœ«      j                  j                  d«       y # 1 sw Y   ŒqxY w)N)rZ   rÇ   z"only valid for codex.profile toolsrV   )rb   r   r½   rA   r9   rd   re   rf   rm   r¹   rÇ   rÔ   s     r   Ú#test_text_profile_rejects_allowlistz8ConfigWriteAllowlist.test_text_profile_rejects_allowlistÏ   s�   € Ø×ÑÔ1Ó2ð 	S°aØ�J‰J T§V¡VÀtÇxÁxÀjÑQÔR÷	Sà�‰Ð:¼CÀÇÁÓ<LÔMØ×Ñ˜Ÿ™°$·&±&ÐSUÑ$VÓW×]Ñ]×sÑsÐuwÕx÷	Sð 	Sús   –*B0Â0B9c                 ó  — | j                   dgdgddifD ]\  }| j                  |¬«      5  | j                  t        «      5  | j	                  | j                  |¬«      «       d d d «       d d d «       Œ^ y # 1 sw Y   ŒxY w# 1 sw Y   ŒuxY w)Nry   rz   Úa)r|   rÊ   )r9   rÐ   rb   r   r½   r¿   r{   s     r   Útest_type_errors_rejectedz.ConfigWriteAllowlist.test_type_errors_rejectedÕ   s”   € Ø—H‘H˜q˜c B 4¨#¨q¨Ð2ò 	FˆCØ—‘ #�Ó&ñ FØ×&Ñ&Ô'9Ó:ñ FØ—J‘J˜tŸz™zÀ˜zÓDÔE÷F÷Fð Fñ	F÷Fð Fú÷Fð Fús#   ªBÁ "A5Á"BÁ5A>Á:BÂB
	c                 ó:  — t        t        | j                  «      dz  dz  «       t        j                  t        j
                  j                  | j                  d«      d¬«       | j                  | j                  d| j                  gddit        j
                  j                  | j                  d«      ¬	«      «      }t        |«      j                  d
   j                  }| j                  |t        «       | j                  |j                   | j                  f«       y )NÚkeyszclearance.keyÚworkTr   Úcpu_secondsé<   ú	auth.json)Úreal_executionrÇ   Úresource_limitsÚ	auth_filer¹   )r   r   r?   r   r   r   r@   r½   r¿   r9   r   ÚadaptersÚrunnerÚassertIsInstancer	   rm   Úwrite_allowlist)rF   rÌ   rè   s      r   Ú.test_gateway_threads_allowlist_to_caged_runnerzCConfigWriteAllowlist.test_gateway_threads_allowlist_to_caged_runnerÛ   sÑ   € Ü”$�t—y‘y“/ FÑ*¨_Ñ<Ô=Ü
�‰”B—G‘G—L‘L §¡¨FÓ3¸dÕCØ�j‰j˜Ÿ™°4ÐPT×PXÑPXÈzØ5BÀBÐ4GÜ.0¯g©g¯l©l¸4¿9¹9ÀkÓ.Rð $ó Tó Uˆô ˜“×&Ñ& wÑ/×6Ñ6ˆØ×Ñ˜fÔ&6Ô7Ø×Ñ˜×/Ñ/°$·(±(°Õ=rI   N)rR   rS   rT   r½   r¿   rÈ   rÍ   rÑ   rÕ   rØ   rÚ   rÝ   rë   rV   rI   r   r·   r·   ¨   s8   „ ò*ò
.òIòSò8ò?ò
9òyòFó>rI   r·   c                   ó`   — e Zd Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ Z	d„ Z
d	„ Zd
„ Zd„ Zd„ Zd„ Zd„ Zy)ÚProfileWriteRulesc           	      ó‚  — t         j                  j                  | j                  d«      }t	        j
                  ||dz   |dz   |dz   |dz   |dz   «      }|j                  |j                  |j                  |j                  |j                  fD ]  }t        j                  |d¬«       Œ t        |j                  d	«       |S )
NÚrunú/wsú/homeú/codex-homeú/authdirr‡   Tr   r/   )r   r   r@   r?   r\   ÚRunDirsÚ	workspacer$   Ú
codex_homeÚauthdirÚtmpr   r    Ú	auth_copy)rF   ÚrrÚdr,   s       r   ÚdirszProfileWriteRules.dirsç   s™   € Ü�W‰W�\‰\˜$Ÿ)™) UÓ+ˆÜ�I‰I�b˜"˜u™* b¨7¡l°B¸Ñ4FÈÈZÉÐY[Ð^dÑYdÓeˆØ—+‘+˜qŸv™v q§|¡|°Q·Y±YÀÇÁÐFò 	*ˆAÜ�K‰K˜ DÖ)ð	*äˆa�k‰k˜4Ô ØˆrI   c                 óÄ   — |j                  d| j                  «       |j                  dd«       t        j                  | j	                  «       fdi | j
                  ddœ|¤ŽS )NÚcron_targetsÚprotect_startupTú/usr/bin/truerV   )Ú	codex_binÚrlimitsrZ   Ú
exec_roots)r[   rE   r\   Útools_profilerü   rA   )rF   r_   s     r   rÌ   zProfileWriteRules.cfgï   sY   € Ø
�‰�n d§i¡iÔ0Ø
�‰Ð'¨Ô.Ü�‰˜tŸy™y›{ð 4°oÈrÐ]a×]cÑ]cØ*,ñ4Ø02ñ4ð 	4rI   c                 óx   ‡— | j                  |«      Š‰t        |d   «      v xs t        ˆfd„|d   D «       «      S )NÚfile_rwc              3   óp   •K  — | ]-  }‰|k(  xs" ‰j                  |t        j                  z   «      –— Œ/ y ­wrK   ©Ú
startswithr   Úsep©Ú.0rû   rQ   s     €r   ú	<genexpr>z-ProfileWriteRules.writable.<locals>.<genexpr>÷   s/   øè ø€ Ò.eÐVW¨q°A©vÒ/Q¸¿¹ÀaÌ"Ï&É&ÁjÓ9QÓ/QÑ.eùó   ƒ36Úrw)rQ   ÚsetÚany©rF   rÌ   rG   rQ   s      @r   ÚwritablezProfileWriteRules.writableõ   s;   ø€ Ø�F‰F�3‹KˆØ”C˜˜I™Ó'Ð'Òe¬3Ó.eÐ[^Ð_cÑ[dÔ.eÓ+eÐerI   c                 ó    ‡— | j                  |«      Š| j                  ||«      xs) ‰t        |d   «      v xs t        ˆfd„|d   D «       «      S )NÚfile_roc              3   óp   •K  — | ]-  }‰|k(  xs" ‰j                  |t        j                  z   «      –— Œ/ y ­wrK   r  r  s     €r   r  z-ProfileWriteRules.readable.<locals>.<genexpr>ü   s.   øè ø€ ÒM¸a�q˜A‘vÒ9 §¡¨a´"·&±&©jÓ!9Ó9ÑMùr  Úro)rQ   r  r  r  r  s      @r   ÚreadablezProfileWriteRules.readableù   sR   ø€ Ø�F‰F�3‹KˆØ—‘˜c 3Ó'ò N¨1´°C¸	±NÓ0CÐ+Cò NÜÓMÀ3ÀtÁ9ÔMÓMð	OrI   c                 ód  — | j                  «       }dD ]g  }| j                  |¬«      5  | j                  | j                  ||«      |› d�«       | j	                  | j                  ||«      |› d�«       d d d «       Œi | j                  | j                  t        |d   «      «       y # 1 sw Y   ŒœxY w)N)r%   r*   r)   r+   r4   r-   r0   r1   )rG   z nicht mehr lesbarz schreibbar (E44-Klasse offen)r  )	rÌ   rÐ   r˜   r  ÚassertFalser  ÚassertNotInrA   r  ©rF   rÌ   rG   s      r   Ú(test_without_allowlist_home_is_read_onlyz:ProfileWriteRules.test_without_allowlist_home_is_read_onlyþ   s²   € Ø�h‰h‹jˆð[ò 	bˆCð —‘ #�Ó&ñ bØ—‘ §¡¨c°3Ó 7¸C¸5Ð@RÐ9SÔTØ× Ñ  §¡¨s°CÓ!8¸S¸EÐA_Ð:`Ôa÷bð bð	bð 	×Ñ˜Ÿ™¤ S¨¡Y£Õ0÷bð bús   ¨AB&Â&B/	c           	      ó"  — | j                  «       }t        j                  |di | j                  d| j                  ¬«      }| j                  t        |d   «      |j                  |j                  |j                  |j                  h«       | j                  |d   dg«       | j                  |j                  |d   «       t        j                  |di | j                  d| j                  d¬«      }| j                  |d   d|j                  g«       y )	Nr   rV   )r  r  rZ   r  rþ   r  r  z	/dev/nullT)r  r  rZ   r  rþ   Úwritable_auth)rü   r\   r  rA   rE   rm   r  rõ   r$   rö   rø   r  r÷   rù   )rF   rû   rÌ   Úrw_auths       r   Ú3test_only_run_dirs_and_dev_null_writable_by_defaultzEProfileWriteRules.test_only_run_dirs_and_dev_null_writable_by_default  sÛ   € Ø�I‰I‹KˆÜ�o‰o˜a¨?ÀBÐRV×RXÑRXÐegØ+/¯9©9ô6ˆà×Ñœ˜S ™Y›¨!¯+©+°q·v±v¸q¿|¹|ÈQÏUÉUÐ)SÔTØ×Ñ˜˜Y™¨+¨Ô7Ø×Ñ˜Ÿ™ C¨¡IÔ.Ü—/‘/ !¨ÈÐVZ×V\ÑV\Ø-/¸d¿i¹iÐW[ô]ˆà×Ñ˜ Ñ+¨k¸1¿;¹;Ð-GÕHrI   c                 ó¸   — | j                  «       }dD ]E  }| j                  | j                  ||«      «       | j                  | j	                  ||«      |«       ŒG y )N)r)   r*   )rÌ   r˜   r  r  r  r  s      r   Útest_kostenwache_class_closedz/ProfileWriteRules.test_kostenwache_class_closed  sP   € ð �h‰h‹jˆØcò 	;ˆCØ�O‰O˜DŸM™M¨#¨sÓ3Ô4Ø×Ñ˜TŸ]™]¨3°Ó4°cÕ:ñ	;rI   c                 óÊ  — | j                  | j                  g¬«      }| j                  | j                  |d«      «       | j	                  | j                  d«      t        |d   «      «       dD ]F  }| j                  | j                  ||«      |«       | j                  | j                  ||«      |«       ŒH | j                  | j                  d«      t        |d   «      «       y )N©rê   r%   zprojekte/app/srcr  )r*   r+   r4   r5   )
rÌ   r9   r˜   r  rd   rQ   r  r  r  r  r  s      r   Ú*test_allowlist_dir_writable_neighbours_notz<ProfileWriteRules.test_allowlist_dir_writable_neighbours_not  s¶   € Ø�h‰h¨¯© zˆhÓ2ˆØ�‰˜Ÿ™ cÐ+AÓBÔCØ�‰�d—f‘fÐ/Ó0´#°c¸$±i³.ÔAØgò 	:ˆCØ×Ñ˜TŸ]™]¨3°Ó4°cÔ:Ø�O‰O˜DŸM™M¨#¨sÓ3°SÕ9ð	:ð 	×Ñ˜Ÿ™ 
Ó+¬S°°T±«^Õ<rI   c                 óB  — | j                  | j                  g¬«      }| j                  | j                  t        |d   «      «       | j                  | j	                  d«      t        |d   «      «       | j                  | j	                  d«      t        |d   «      «       y )Nr%  r  rŒ   r%   r  )rÌ   r9   r  r  rQ   rd   rË   s     r   Ú6test_dir_level_with_protected_entries_gets_no_dir_rulezHProfileWriteRules.test_dir_level_with_protected_entries_gets_no_dir_rule$  sy   € ð �h‰h¨¯© zˆhÓ2ˆØ×Ñ˜Ÿ™¤3 s¨4¡y£>Ô2Ø×Ñ˜Ÿ™Ð 3Ó4´c¸#¸d¹)³nÔEØ�‰�d—f‘fÐ3Ó4´c¸#¸i¹.Ó6IÕJrI   c                 ó¸  — | j                  | j                  | j                  g¬«      }| j                  | j	                  |d«      «       | j                  | j	                  |d«      «       | j                  | j                  |d«      d«       dD ]I  }| j                  | j                  ||«      |«       | j                  | j	                  ||«      |› d�«       ŒK y )Nr%  r%   r*   r&   z%Secret im Allowlist-Ordner erreichbar)r'   r(   r)   z im Allowlist-Ordner schreibbar)rÌ   r9   rD   r˜   r  r  r  r  s      r   Ú3test_allowlist_carves_secret_hooks_and_cron_targetszEProfileWriteRules.test_allowlist_carves_secret_hooks_and_cron_targets-  s»   € Ø�h‰h¨¯©°$·+±+Ð'>ˆhÓ?ˆØ�‰˜Ÿ™ cÐ+AÓBÔCØ�‰˜Ÿ™ cÐ+TÓUÔVØ×Ñ˜Ÿ™ sÐ,?Ó@ÐBiÔjð9ò 	_ˆCà�O‰O˜DŸM™M¨#¨sÓ3°SÔ9Ø×Ñ˜TŸ]™]¨3°Ó4¸¸Ð=\Ð6]Õ^ñ	_rI   c                 ó  — | j                  | j                  gd¬«      }| j                  | j                  |d«      «       | j	                  | j                  |d«      «       | j	                  | j                  |d«      «       y )NF)rê   rÿ   r'   r&   r-   )rÌ   r9   r˜   r  r  r  rË   s     r   Ú:test_protect_startup_off_opens_hooks_only_inside_allowlistzLProfileWriteRules.test_protect_startup_off_opens_hooks_only_inside_allowlist7  se   € Ø�h‰h¨¯© zÀ5ˆhÓIˆØ�‰˜Ÿ™ cÐ+OÓPÔQØ×Ñ˜Ÿ™ sÐ,?Ó@ÔAØ×Ñ˜Ÿ™ s¨OÓ<Õ=rI   c                 óð   — | j                  t        j                  «      5 }| j                  | j                  g¬«       d d d «       | j                  dt        j                  «      «       y # 1 sw Y   Œ/xY w)Nr%  zread-only protected)rb   r\   rc   rÌ   r:   rd   re   rf   rÔ   s     r   Ú-test_build_time_rejects_entry_inside_cron_dirz?ProfileWriteRules.test_build_time_rejects_entry_inside_cron_dir=  sY   € Ø×Ñœq×4Ñ4Ó5ð 	6¸Ø�H‰H d§m¡m _ˆHÔ5÷	6à�‰Ð+¬S°·±Ó-=Õ>÷	6ð 	6ús    A,Á,A5c                 óÐ   — | j                  t        j                  «      5  | j                  | j	                  d«      g| j	                  d«      ¬«       d d d «       y # 1 sw Y   y xY w)Nr5   r±   )rê   r³   )rb   r\   rc   rÌ   rQ   rM   s    r   Ú.test_build_time_rejects_overlap_with_runs_rootz@ProfileWriteRules.test_build_time_rejects_overlap_with_runs_rootB  sT   € Ø×Ñœq×4Ñ4Ó5ñ 	^Ø�H‰H d§f¡f¨ZÓ&8Ð%9ÀTÇVÁVÈOÓE\ˆHÔ]÷	^÷ 	^ñ 	^ús    3AÁA%c           	      ó˜  — | j                  «       }t        j                  |di ¬«      }| j                  t	        |d   «      |j
                  |j                  |j                  |j                  h«       dD ]N  }| j                  |j                  |g «      D �cg c]   }|j                  | j                  «      sŒ|‘Œ" c}|«       ŒP y c c}w )Nr   )r  r  r  )r  r  r  r  Úfile_x)rü   r\   Útext_profilerm   r  rõ   r$   rö   rø   r  Úgetr	  rA   )rF   rû   rÌ   Úkeyr,   s        r   Ú#test_text_profile_has_no_home_rulesz5ProfileWriteRules.test_text_profile_has_no_home_rulesF  sš   € Ø�I‰I‹KˆÜ�n‰n˜Q¨/À2ÔFˆØ×Ñœ˜S ™Y›¨!¯+©+°q·v±v¸q¿|¹|ÈQÏUÉUÐ)SÔTØ?ò 	YˆCØ×Ñ¨¯©°°bÓ)9ÖR A¸Q¿\¹\È$Ï&É&Õ=QšaÒRÐTWÕXñ	YùÚRs   Â C
Â8C
N)rR   rS   rT   rü   rÌ   r  r  r  r!  r#  r&  r(  r*  r,  r.  r0  r6  rV   rI   r   rí   rí   æ   sO   „ òò4òfòOò
1ò	Iò;ò=òKò_ò>ò?ò
^óYrI   rí   c                   ó*   — e Zd Zd„ Zd„ Zd„ Zd„ Zd„ Zy)ÚRunnerWriteAllowlistc                 ó–  — t        j                  t         j                  j                  | j                  d«      d¬«       t         j                  j                  | j                  d«      }t        |d«       |j                  dd«       t        t         j                  j                  | j                  d«      f|| j                  d ddœ|¤ŽS )	Nrà   Tr   rã   r/   rÀ   r¿   )ræ   rZ   Úsecret_filesrÿ   )	r   r   r   r@   r?   r    r[   r	   rA   )rF   r_   Úauths      r   rè   zRunnerWriteAllowlist.runnerO  s–   € Ü
�‰”B—G‘G—L‘L §¡¨FÓ3¸dÕCÜ�w‰w�|‰|˜DŸI™I {Ó3ˆÜˆd�DÔØ
�‰�i Ô)Ü¤§¡§¡¨T¯Y©Y¸Ó ?ð OÈ4Ð[_×[aÑ[aØ-1À4ñOØKMñOð 	OrI   c                 ó¸  — | j                  d«      | j                  | j                  d«      | j                  d«      fD ]X  }| j                  |¬«      5  | j                  t        j
                  «      5  | j                  |g¬«       d d d «       d d d «       ŒZ | j                  | j                  «       j                  d«       y # 1 sw Y   Œ>xY w# 1 sw Y   Œ›xY w)Nr‹   rœ   r”   rÏ   r%  rV   )	rQ   rA   rÐ   rb   r\   rc   rè   rm   rê   )rF   rg   s     r   Ú%test_runner_validates_at_constructionz:RunnerWriteAllowlist.test_runner_validates_at_constructionW  s·   € Ø—f‘f˜XÓ&¨¯©°·±°w³ÀÇÁÈ
ÓASÐTò 	9ˆEØ—‘ E�Ó*ñ 9Ø×&Ñ&¤q×'<Ñ'<Ó=ñ 9Ø—K‘K°°�KÔ8÷9÷9ð 9ð	9ð 	×Ñ˜Ÿ™›×6Ñ6¸Õ;÷9ð 9ú÷9ð 9ús$   Á CÁ3CÂCÃCÃ	CÃC	c                 ó”   — | j                  t        «      5  | j                  d| j                  g¬«       d d d «       y # 1 sw Y   y xY w)NÚtext)rÀ   rê   )rb   Ú
ValueErrorrè   r9   rM   s    r   Ú*test_runner_text_profile_rejects_allowlistz?RunnerWriteAllowlist.test_runner_text_profile_rejects_allowlist^  s?   € Ø×ÑœzÓ*ñ 	DØ�K‰K ¸¿¹¸
ˆKÔC÷	D÷ 	Dñ 	Dús	   –>¾Ac           	      ó~  ‡‡— | j                  | j                  g¬«      }| j                  |j                  | j                  f«       t        j
                  j                  | j                  d«      }t        j                  ||dz   |dz   |dz   |dz   |dz   «      }|j                  |d«      }| j                  d	«      Š| j                  ‰t        |d
   «      v xs t        ˆfd„|d   D «       «      «       | j                  d«      Š| j                  ‰t        |d
   «      v xs t        ˆfd„|d   D «       «      «       y )Nr%  rú   rð   rñ   rò   ró   r‡   r   r%   r  c              3   ób   •K  — | ]&  }‰j                  |t        j                  z   «      –— Œ( y ­wrK   r  )r  rû   Úmains     €r   r  zRRunnerWriteAllowlist.test_runner_threads_allowlist_into_profile.<locals>.<genexpr>i  s#   øè ø€ Ò:jÐ[\¸4¿?¹?È1ÌrÏvÉvÉ:×;VÑ:jùó   ƒ,/r  r*   c              3   ób   •K  — | ]&  }‰j                  |t        j                  z   «      –— Œ( y ­wrK   r  )r  rû   rD   s     €r   r  zRRunnerWriteAllowlist.test_runner_threads_allowlist_into_profile.<locals>.<genexpr>k  s*   øè ø€ Ò=oÐ`a¸f×>OÑ>OÐPQÔTV×TZÑTZÑPZ×>[Ñ=oùrE  )rè   r9   rm   rê   r   r   r@   r?   r\   rô   Ú
_build_cfgrQ   r˜   r  r  r  )rF   rï   rú   rü   rÌ   rD   rD  s        @@r   Ú*test_runner_threads_allowlist_into_profilez?RunnerWriteAllowlist.test_runner_threads_allowlist_into_profileb  s  ù€ Ø�k‰k¨4¯8©8¨*ˆkÓ5ˆØ×Ñ˜×,Ñ,¨t¯x©x¨kÔ:Ü�W‰W�\‰\˜$Ÿ)™) TÓ*ˆÜ�y‰y˜˜R %™Z¨¨g©°r¸MÑ7IÈ2ÐPZÉ?Ð\^ÐagÑ\gÓhˆØ�n‰n˜T ?Ó3ˆØ�v‰vÐ,Ó-ˆØ�‰˜¤ C¨	¡NÓ 3Ð3Òj´sÓ:jÐ`cÐdhÑ`iÔ:jÓ7jÔkØ—‘ÐAÓBˆØ×Ñ˜¤3 s¨9¡~Ó#6Ð6Òo¼#Ó=oÐehÐimÑenÔ=oÓ:oÕprI   c           
      ór  — | j                  d«      }t        j                  |«        G d„ dt        «      }t        j                  j                  | j                  d«      }t        |d«       t        j                  t        j                  j                  | j                  d«      d¬«        |t        j                  j                  | j                  d«      d	|| j                  t        «       d|gd
¬«      }t        j                  |«       t        j                  | j                  d«      |«       d}|j                  t        |di d«      «      }| j                  |j                  d«       | j                  t        j                   t        j                  j                  | j                  d«      «      g «       y )Nzprojekte/swapc                   ó   — e Zd Zd„ Zy)úbRunnerWriteAllowlist.test_entry_swapped_for_symlink_after_construction_fails_closed.<locals>.NoBusc                  ó   — y)NTrV   rM   s    r   Úbus_reachablezpRunnerWriteAllowlist.test_entry_swapped_for_symlink_after_construction_fails_closed.<locals>.NoBus.bus_reachablet  s   € ØrI   N)rR   rS   rT   rM  rV   rI   r   ÚNoBusrK  s  s   „ órI   rN  rã   r/   rà   Tr   r¿   z
/bin/false)rÀ   ræ   rZ   r:  rÿ   rê   Úsystemctl_pathr7   )r   r   r   r   rI   é
   ÚWRITE_ALLOWLIST_INVALID)rQ   r   r   r	   r   r@   r?   r    rA   r  ÚrmdirrC   rï   r
   rm   Ú
error_codeÚlistdir)rF   ÚswaprN  r;  rï   ÚargvÚrs          r   Ú>test_entry_swapped_for_symlink_after_construction_fails_closedzSRunnerWriteAllowlist.test_entry_swapped_for_symlink_after_construction_fails_closedm  s0  € ð �v‰v�oÓ&ˆÜ
�‰�DÔô	Ô$ô 	ô �w‰w�|‰|˜DŸI™I {Ó3ˆÜˆd�DÔÜ
�‰”B—G‘G—L‘L §¡¨FÓ3¸dÕCÙ”B—G‘G—L‘L §¡¨FÓ3¸WÐPTÐ`d×`fÑ`fÜ!$£¸ÈtÈfØ#/ô1ˆô 	�‰�ŒÜ
�
‰
�4—6‘6˜)Ó$ dÔ+ð =ˆØ�G‰G”G˜D # r¨2Ó.Ó/ˆØ×Ñ˜Ÿ™Ð'@ÔAØ×ÑœŸ™¤B§G¡G§L¡L°·±¸FÓ$CÓDÀbÕIrI   N)rR   rS   rT   rè   r=  rA  rH  rX  rV   rI   r   r8  r8  N  s   „ òOò<òDò	qóJrI   r8  Ú__main__)r,   )!rU   r   r;   ÚunittestÚpathlibr   Úaria_router.configr   r   Úaria_router.gatewayr   r§   r   r   r\   Ú"aria_router.isolation.caged_runnerr	   Úaria_router.runnerr
   Útests.helpersr   r   rÃ   rÄ   r    ÚTestCaser"   rX   r·   rí   r8  rR   rD  rV   rI   r   ú<module>rb     sÌ   ðñ1ó 
Û Û Ý ç GÝ 'Ý /Ý /Ý ?Ý &ß 0â	D€Ø ¨)°YÀÈ(Ø˜Ð0°$¸ÀwÐPTðV€óô%)˜×)Ñ)ô %)ôP^JÐ.ô ^JôB;>Ð,ô ;>ô|eYÐ)ô eYôP6JÐ,ô 6Jðr ˆzÒØ€H‡M�M…Oð rI   