/**
 * @license
 * Copyright 2026 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import { describe, it, expect } from 'vitest';
import { LinuxSandboxManager } from './LinuxSandboxManager.js';
describe('LinuxSandboxManager', () => {
    const workspace = '/home/user/workspace';
    it('correctly outputs bwrap as the program with appropriate isolation flags', async () => {
        const manager = new LinuxSandboxManager({ workspace });
        const req = {
            command: 'ls',
            args: ['-la'],
            cwd: workspace,
            env: {},
        };
        const result = await manager.prepareCommand(req);
        expect(result.program).toBe('sh');
        expect(result.args[0]).toBe('-c');
        expect(result.args[1]).toBe('bpf_path="$1"; shift; exec bwrap "$@" 9< "$bpf_path"');
        expect(result.args[2]).toBe('_');
        expect(result.args[3]).toMatch(/gemini-cli-seccomp-.*\.bpf$/);
        const bwrapArgs = result.args.slice(4);
        expect(bwrapArgs).toEqual([
            '--unshare-all',
            '--new-session',
            '--die-with-parent',
            '--ro-bind',
            '/',
            '/',
            '--dev',
            '/dev',
            '--proc',
            '/proc',
            '--tmpfs',
            '/tmp',
            '--bind',
            workspace,
            workspace,
            '--seccomp',
            '9',
            '--',
            'ls',
            '-la',
        ]);
    });
    it('maps allowedPaths to bwrap binds', async () => {
        const manager = new LinuxSandboxManager({
            workspace,
            allowedPaths: ['/tmp/cache', '/opt/tools', workspace],
        });
        const req = {
            command: 'node',
            args: ['script.js'],
            cwd: workspace,
            env: {},
        };
        const result = await manager.prepareCommand(req);
        expect(result.program).toBe('sh');
        expect(result.args[0]).toBe('-c');
        expect(result.args[1]).toBe('bpf_path="$1"; shift; exec bwrap "$@" 9< "$bpf_path"');
        expect(result.args[2]).toBe('_');
        expect(result.args[3]).toMatch(/gemini-cli-seccomp-.*\.bpf$/);
        const bwrapArgs = result.args.slice(4);
        expect(bwrapArgs).toEqual([
            '--unshare-all',
            '--new-session',
            '--die-with-parent',
            '--ro-bind',
            '/',
            '/',
            '--dev',
            '/dev',
            '--proc',
            '/proc',
            '--tmpfs',
            '/tmp',
            '--bind',
            workspace,
            workspace,
            '--bind',
            '/tmp/cache',
            '/tmp/cache',
            '--bind',
            '/opt/tools',
            '/opt/tools',
            '--seccomp',
            '9',
            '--',
            'node',
            'script.js',
        ]);
    });
});
//# sourceMappingURL=LinuxSandboxManager.test.js.map