ai-agent-book 精选快照（<2MB 代码与文档，来自 github.com/bojieli/ai-agent-book）

chapter9/self-modifying-agent/test_candidate_sandbox.py

@@ -0,0 +1,44 @@
+import unittest
+from unittest.mock import patch
+
+from candidate_sandbox import MAX_SOURCE_BYTES, SandboxError, _docker_command, run_in_sandbox
+
+
+class CandidateSandboxConfigurationTest(unittest.TestCase):
+    def test_docker_command_enforces_isolation_and_resource_limits(self):
+        command = _docker_command("sandbox:test", "candidate-test")
+        rendered = " ".join(command)
+        for expected in (
+            "--network none",
+            "--ipc none",
+            "--read-only",
+            "--cap-drop ALL",
+            "--security-opt no-new-privileges:true",
+            "--user 65534:65534",
+            "--pids-limit 16",
+            "--memory 64m",
+            "--memory-swap 64m",
+            "--cpus 0.5",
+            "--ulimit cpu=2:2",
+            "--log-driver none",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, rendered)
+        self.assertNotIn("--volume", command)
+        self.assertNotIn("--mount", command)
+
+    def test_oversized_source_is_rejected_before_docker_starts(self):
+        with patch("candidate_sandbox._ensure_image") as ensure_image:
+            with self.assertRaisesRegex(SandboxError, "exceeds 256 KiB"):
+                run_in_sandbox("validate", "x" * (MAX_SOURCE_BYTES + 1), [])
+        ensure_image.assert_not_called()
+
+    def test_malformed_unicode_is_rejected_before_docker_starts(self):
+        with patch("candidate_sandbox._ensure_image") as ensure_image:
+            with self.assertRaisesRegex(SandboxError, "not valid JSON data"):
+                run_in_sandbox("validate", "\ud800", [])
+        ensure_image.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()