From 975248500c391fcb2b27fcb3ce78f4ad7bb30a00 Mon Sep 17 00:00:00 2001 From: Ousama Ben Younes Date: Mon, 13 Jul 2026 15:47:01 +0000 Subject: [PATCH] fix: propagate sandbox proxy environment aliases Centralize sandbox subprocess environment setup and include lowercase all_proxy/no_proxy aliases alongside uppercase proxy aliases and CA bundle variables. RED->GREEN: tests/test_session_entries.py failed before build_sandbox_environment existed; now 5 passed. Full suite: 181 passed, 2 warnings. --- strix/runtime/session_manager.py | 41 ++++++++++++++++++++++---------- tests/test_session_entries.py | 21 ++++++++++++++++ 2 files changed, 50 insertions(+), 12 deletions(-) diff --git a/strix/runtime/session_manager.py b/strix/runtime/session_manager.py index 62204385..34475d82 100644 --- a/strix/runtime/session_manager.py +++ b/strix/runtime/session_manager.py @@ -26,6 +26,11 @@ logger = logging.getLogger(__name__) # In-container Caido sidecar port (matches the image's caido-cli bind). _CONTAINER_CAIDO_PORT = 48080 +_CONTAINER_CAIDO_SCHEME = "http" +_CONTAINER_CAIDO_HOST = "127.0.0.1" +_HOST_GATEWAY_NAME = "host.docker.internal" +_NO_PROXY_VALUE = "localhost,127.0.0.1" +_CA_BUNDLE_PATH = "/etc/ssl/certs/ca-certificates.crt" _SESSION_CACHE: dict[str, dict[str, Any]] = {} @@ -35,6 +40,28 @@ _WORKSPACE_ROOT = "/workspace" _PROTECTED_METADATA_NAMES = (".git", ".agents", ".codex") +def _container_caido_url() -> str: + return f"{_CONTAINER_CAIDO_SCHEME}://{_CONTAINER_CAIDO_HOST}:{_CONTAINER_CAIDO_PORT}" + + +def build_sandbox_environment() -> dict[str, str]: + """Return environment variables inherited by sandbox subprocesses.""" + container_caido_url = _container_caido_url() + return { + "PYTHONUNBUFFERED": "1", + "HOST_GATEWAY": _HOST_GATEWAY_NAME, + "http_proxy": container_caido_url, + "https_proxy": container_caido_url, + "HTTP_PROXY": container_caido_url, + "HTTPS_PROXY": container_caido_url, + "ALL_PROXY": container_caido_url, + "all_proxy": container_caido_url, + "NO_PROXY": _NO_PROXY_VALUE, + "no_proxy": _NO_PROXY_VALUE, + "REQUESTS_CA_BUNDLE": _CA_BUNDLE_PATH, + "SSL_CERT_FILE": _CA_BUNDLE_PATH, + } + def _host_identity_env() -> dict[str, str]: # Read the platform through a local so it is not narrowed to whichever OS is @@ -297,20 +324,10 @@ async def create_or_reuse( # picks up these env vars automatically. ``NO_PROXY`` keeps the # agent-browser CDP daemon's localhost traffic from looping back # through Caido. - container_caido_url = f"http://127.0.0.1:{_CONTAINER_CAIDO_PORT}" + container_caido_url = _container_caido_url() manifest = Manifest( entries=entries, - environment=Environment( - value={ - "PYTHONUNBUFFERED": "1", - "HOST_GATEWAY": "host.docker.internal", - **_host_identity_env(), - "http_proxy": container_caido_url, - "https_proxy": container_caido_url, - "ALL_PROXY": container_caido_url, - "NO_PROXY": "localhost,127.0.0.1", - }, - ), + environment=Environment(value={**build_sandbox_environment(), **_host_identity_env()}), ) logger.info( diff --git a/tests/test_session_entries.py b/tests/test_session_entries.py index 60d6abfd..ff6e0ed6 100644 --- a/tests/test_session_entries.py +++ b/tests/test_session_entries.py @@ -18,9 +18,15 @@ from strix.runtime.session_manager import ( build_extra_file_bind_mounts, build_extra_file_entries, build_manifest_entries, + build_sandbox_environment, ) +EXPECTED_CAIDO_URL = "http://127.0.0.1:48080" +EXPECTED_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt" +EXPECTED_NO_PROXY = "localhost,127.0.0.1" + + def _source(subdir: str, path: str, *, protect_metadata: bool = False) -> dict[str, Any]: return {"source_path": path, "workspace_subdir": subdir, "protect_metadata": protect_metadata} @@ -334,3 +340,18 @@ def test_only_bind_mount_capable_backends_are_registered_as_such() -> None: finally: _BACKENDS.pop("e2b", None) _BIND_MOUNT_BACKENDS.discard("e2b") + + +def test_sandbox_environment_exports_proxy_and_ca_aliases() -> None: + env = build_sandbox_environment() + + assert env["http_proxy"] == EXPECTED_CAIDO_URL + assert env["https_proxy"] == EXPECTED_CAIDO_URL + assert env["HTTP_PROXY"] == EXPECTED_CAIDO_URL + assert env["HTTPS_PROXY"] == EXPECTED_CAIDO_URL + assert env["ALL_PROXY"] == EXPECTED_CAIDO_URL + assert env["all_proxy"] == EXPECTED_CAIDO_URL + assert env["NO_PROXY"] == EXPECTED_NO_PROXY + assert env["no_proxy"] == EXPECTED_NO_PROXY + assert env["REQUESTS_CA_BUNDLE"] == EXPECTED_CA_BUNDLE + assert env["SSL_CERT_FILE"] == EXPECTED_CA_BUNDLE