External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add support for per-project sandbox overlays (#294)

Browse Source 
* feat: Add support for per-project sandbox overlays

* chore: Maintain consistency with TUI experience

* fix: Code review fixes
This commit is contained in:
Abhisek Datta
2026-05-26 21:06:57 +05:30
committed by GitHub
parent 321896996f
commit b03e82e3f2
25 changed files with 1837 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/ui/sandbox_violation_test.go
+58
View File
@@ -120,3 +120,61 @@ func TestRenderSandboxViolationRejectsNilRecord(t *testing.T) {
assert.Error(t, RenderSandboxViolation(&buf, nil))
assert.Error(t, RenderSandboxViolation(&buf, &pmgsandbox.ViolationCacheRecord{}))
}
func TestRenderSandboxViolationIncludesRememberHint(t *testing.T) {
var buf bytes.Buffer
rec := &pmgsandbox.ViolationCacheRecord{
SchemaVersion: pmgsandbox.ViolationCacheSchemaVersion,
Report: &pmgsandbox.ViolationReport{
SandboxName: pmgsandbox.DriverSeatbelt,
PolicyName: "npm-restrictive",
Violations: []pmgsandbox.Violation{{
Kind: pmgsandbox.ViolationKindFSWrite,
Target: "/repo/.astro",
RuleLabel: "deny write",
}},
},
}
require.NoError(t, RenderSandboxViolation(&buf, rec))
assert.Contains(t, buf.String(), "pmg sandbox allow --last --all")
}
func TestRenderSandboxViolationOmitsRememberHintWithoutOverride(t *testing.T) {
var buf bytes.Buffer
rec := &pmgsandbox.ViolationCacheRecord{
SchemaVersion: pmgsandbox.ViolationCacheSchemaVersion,
Report: &pmgsandbox.ViolationReport{
SandboxName: pmgsandbox.DriverSeatbelt,
PolicyName: "npm-restrictive",
Violations: []pmgsandbox.Violation{{
Kind: pmgsandbox.ViolationKindGenericDeny,
RuleLabel: "deny generic",
}},
},
}
require.NoError(t, RenderSandboxViolation(&buf, rec))
assert.NotContains(t, buf.String(), "pmg sandbox allow --last --all")
}
func TestRenderSandboxViolationOmitsRememberHintForSensitiveTarget(t *testing.T) {
var buf bytes.Buffer
rec := &pmgsandbox.ViolationCacheRecord{
SchemaVersion: pmgsandbox.ViolationCacheSchemaVersion,
Report: &pmgsandbox.ViolationReport{
SandboxName: pmgsandbox.DriverSeatbelt,
PolicyName: "npm-restrictive",
Violations: []pmgsandbox.Violation{{
Kind: pmgsandbox.ViolationKindFSRead,
Target: "/repo/.env",
RuleLabel: "deny read",
}},
},
}
require.NoError(t, RenderSandboxViolation(&buf, rec))
out := buf.String()
// The "Suggested override" line still shows so users see the manual fix.
assert.Contains(t, out, "--sandbox-allow read=")
// But the persistent-save hint is suppressed because `pmg sandbox allow`
// would refuse this target without --force.
assert.NotContains(t, out, "pmg sandbox allow --last --all")
}