test(bwrap): assert a host env var is absent inside the sandbox (#87)

[HusseinAdeiza]

Closes the test item on #87. The --clearenv fix itself already landed in #92 before the issue was filed.

BwrapBackendTest asserts --clearenv is ordered before the first --setenv. That stays green if the flag stops having any effect, which is the failure mode that matters here.

This runs bwrap for real, using the env flags extracted from build_bwrap_args/7 rather than restated, so it can't drift from the allowlist it polices:

sentinel = "GENSWARMS_HOST_SECRET_SENTINEL"
System.put_env(sentinel, value)
inside = System.cmd(bwrap, @base_flags ++ env_argv ++ ["/usr/bin/env"], stderr_to_stdout: true)

refute inside =~ "#{sentinel}="
assert inside =~ "GENSWARMS_ALLOWED=allowed-value"   # control: allowlist still applied

A second test asserts the same argv without --clearenv does inherit the sentinel, so the first can't pass for the wrong reason. Verified by deleting "--clearenv" from the argv: the first test fails with production argv lost --clearenv.

Skips cleanly when bwrap is absent or user namespaces are unavailable.

mix format on the new file; mix test test/genswarms/backends/ is 224 tests, 1 failure, 12 skipped. The one failure is rootless_overlay_test.exs needing /nix/store, and it fails identically on unmodified main.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b3614849-0eb4-4af8-950c-39be4f950426

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}