Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

tests: qualify policy probe Python inside the confined worker

Open
  • Is something wrong?
#2,304 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bun, python, typescript
Domain
testing-qa, tooling

Research direction

Start with tests/fixtures/policy-boundary-probe.ts at the cited interpreter-selection lines and inspect how the fixture runs probes inside its confined worker. Reproduce the host-home Python failure and verify the retained tool result and missing-attack assertion. Done means both real Claude and Pi cases produce the required attack receipts while preserving policy and neighboring-edit checks; also test and clearly diagnose an unsupported interpreter.

Written by the indexing model from the issue text.

Description

agent-ready area: ci area: ui-sdk priority: p2 type: test

Context

While continuing #959 / PR #2070, the two interactive policy-write boundary cases failed locally at attacks: expected one Claude / two Pi ATTACK-RESULT records, received zero. An independent clean control at main 8c4d191e761bec31f3267d3b612a77712692f54a reproduces the same failures without the voice changes.

The fixture selects the host interpreter through Bun.which("python3") and embeds that absolute path in generated worker code (tests/fixtures/policy-boundary-probe.ts:217, :253-254). When PATH selects a tool-manager installation beneath the host home directory, the real confined shell reports exit 127 and that interpreter path as unavailable. The outer fixture itself exits successfully; the meaningful nonempty attack assertion correctly rejects the missing probe. The interpreter file exists on the host, so host-only discovery is insufficient evidence that it is usable inside the worker.

A command-scoped PATH choosing system Python reaches and passes both Claude and Pi interactive attack assertions with all existing guards intact. Complete control results are retained with the source PR. No production boundary or assertion has been changed. This differs from #1710's root/nested-procfs mount failure: this reproduction runs as an ordinary user and reaches the worker and the tool result.

Scope

Make the offline integrated fixture select or qualify an interpreter that actually runs inside its existing confined worker. Keep the execution and protected-policy assertions meaningful and retain a clear diagnostic for an unavailable interpreter.

Acceptance criteria

  • Reproduce with PATH preferring a host-home Python and retain the actual confined tool result plus the missing-attack assertion.
  • Qualify a worker-visible interpreter or fail explicitly before claiming attack execution; test the unsupported interpreter path deliberately.
  • Run both real Claude and Pi interactive cases and assert nonempty descriptor/mapping/proc attack receipts, unchanged policy bytes and membership, and the permitted neighboring edit.
  • Preserve offline namespaces/preloads, worker mounts, native write refusals and the existing attack assertions. Do not expose the host home directory or treat exit 127 / absent records as passing proof.

Out of scope

Production worker mount policy, provider behavior, global PATH configuration, root-host support, changing the voice adapters or weakening assertion/deadline guards.

Contract impact

Fixture-only; no product contract or delivery change selected. Source/citation verification and implementation scoping are recorded below.

Verification

Unchanged main control: 26 passed / two interactive failures across the policy boundary and runtime-record files. Rebased voice branch: 149 passed / the same two interactive failures across eleven files. A retained real fixture JSON identifies the failing shell result as exit 127 for the host-home interpreter. Repeat with PATH selecting system Python, without changing source, native mounts, namespace/preload guards or assertions; retain both complete adapter outcomes.

Triage 2026-10-17 at main 9d5cd00b7646ffee951c7a29a38717989f7fd868: both host-side interpreter selections are still present at the cited fixture lines. The retained real-worker exit-127 result and command-scoped system-interpreter control establish the failure boundary without a new worker authority or product ruling. Scope is the existing offline fixture's interpreter qualification and truthful unsupported-path diagnosis; the brief is ready. Preserve p2 and standalone membership: this cross-adapter fixture repair does not itself deliver the voice outcome and #736 already has 100 native children.

Dominant language
TypeScript
Stars
1
Forks
0
Avg merge
4h 40m
Merged PRs (30d)
953

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from schlessera/brain-kit

All issues in schlessera/brain-kit

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.