branderson
832aaef3d8
Addresses the "no regression protection" gap called out in Security notes: everything there was hand-verified at a point in time, with nothing to catch a future change silently breaking one of those properties again - which had already happened once (the ipset -exist bug hit twice, on two different ipsets, before being caught). entrypoint.sh gets a SANDBOX_TEST_MODE hook: run the real DNS-proxy/ firewall/logging setup exactly as normal, then exec `sleep infinity` as node instead of nvim (which needs a real tty). Lets the suite attach to a live, fully-initialized container and assert against it, rather than reimplementing the setup sequence in the test file where it could drift out of sync with the real thing. test/static.bats: fast, no Docker required - sudo/sudoers absence, every ipset add is duplicate-safe, no docker.sock/host-credential mounts, the ~/.claude read-only overlay lines are present, claude-sandbox-allow's input validation. test/runtime.bats: builds the image, boots a container in test mode, asserts IPv6 is blocked, DNS/IP allowlist enforcement in both directions, GitHub read-only, no working sudo/iptables/init-firewall.sh as node, capabilities are actually stripped (not just absent because docker exec doesn't have them to begin with), ulogd2 runs unprivileged, and the dynamic-ipset CDN-rotation fix actually re-syncs on a fresh DNS answer. Container/network names are derived from bats' own BATS_FILE_TMPDIR rather than $$ (caught via a real failure: bats reruns each file's top-level code in a fresh subshell per test, so $$ differs across setup_file/tests/ teardown_file, silently pointing them at different, nonexistent containers - several tests "passed" only because asserting failure against a missing container also happens to return nonzero). BATS_FILE_TMPDIR is guaranteed stable across the whole file's run, verified directly before relying on it. All 22 tests pass cleanly against the current sandbox.