Help us shape the future of Go! Take the 2026 Go Developer Survey

enforcertest

package
v1.0.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 15, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package enforcertest is an agent.Enforcer that starts no process: a caller tests what it does around Prepare, Run and Release, and what its grants let a turn do, with a Go function playing the agent. It lives beside agenttest rather than in it because it imports agent, which agent's own tests could then not import agenttest from.

The fake checks grants and requests with the code the real enforcers use (agent.NewPolicy, agent.Admit) and judges what its agent tries with the policy's own Reads, Writes, Runs and Allows. It has no platform: its policy names no system paths and no denied paths, and it knows a VCS executable by its name alone.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Enforcer

type Enforcer struct {
	// Sandbox is the kind: agent.SandboxNone when empty.
	Sandbox string
	// Image is what a container kind runs, as agent.NewContainer is given
	// it, or the template of a sandbox kind, as agent.NewSbx is.
	Image string
	// SandboxAgent is the agent a sandbox kind is prepared for, as
	// agent.NewSbx is given it; empty is agent.AgentClaude.
	SandboxAgent string
	// PrepareErr, when set, is what Prepare returns: a platform that cannot
	// enforce the kind returns one that wraps agent.ErrUnsupported.
	PrepareErr error
	// Agent plays the agent of every turn. Nil is an agent that does nothing
	// and succeeds. The fake never runs a real agent process: a test that
	// cares what the agent itself does, rather than what its grants let it
	// do, sets Agent and asserts what the turn given to it could and could
	// not reach.
	Agent func(ctx context.Context, turn *Turn) (*agent.Result, error)
	// contains filtered or unexported fields
}

Enforcer fakes the enforcer of one sandbox kind.

func (*Enforcer) Prepare

func (e *Enforcer) Prepare(ctx context.Context, g agent.Grants) (agent.Session, error)

Prepare checks the grants the way a real enforcer does and starts nothing.

func (*Enforcer) Sessions

func (e *Enforcer) Sessions() []*Session

Sessions are the sessions prepared so far, oldest first.

type Session

type Session struct {
	// contains filtered or unexported fields
}

Session is a prepared fake session.

func (*Session) Policy

func (s *Session) Policy() agent.Policy

Policy is the policy of the grants alone.

func (*Session) Release

func (s *Session) Release(context.Context) error

Release marks the session released.

func (*Session) Released

func (s *Session) Released() bool

Released reports whether Release was called.

func (*Session) Requests

func (s *Session) Requests() []agent.Request

Requests are the requests the session ran, as it admitted them.

func (*Session) Run

func (s *Session) Run(ctx context.Context, req agent.Request) (*agent.Result, error)

Run admits the request the way a real session does and hands the turn to the enforcer's Agent.

type Turn

type Turn struct {
	Request agent.Request
	Policy  agent.Policy
}

Turn is what a fake agent is handed: the admitted request, the policy it runs under, and the things an agent tries, each judged by the policy. A refusal wraps fs.ErrPermission.

func (*Turn) Exec

func (t *Turn) Exec(name string) error

Exec reports whether the turn could run an executable, and runs nothing. The fake has no machine to look for VCS executables on, so a denied name is denied under every path that ends in it. Any other name runs, and any other path runs when the policy runs it.

func (*Turn) ReadFile

func (t *Turn) ReadFile(path string) ([]byte, error)

ReadFile reads a file of this machine when the policy reads it.

func (*Turn) UseTool

func (t *Turn) UseTool(tool string) error

UseTool reports whether the turn has a tool: a built-in one, or one of an MCP server ("mcp__<server>__<tool>").

func (*Turn) WriteFile

func (t *Turn) WriteFile(path string, data []byte) error

WriteFile writes a file of this machine when the policy writes it.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL