tests/test_egress.py

• _clean_egress · function · L24-L31 — def _clean_egress(monkeypatch): # Each test starts from a known state: no runtime grants, egress OFF unless # the test opts in via _allowlist. egress_mode() reads the env fresh, so # monkeypatch.setenv is enough to flip enforcement — no config rebuild.
• _allowlist · function · L34-L35 — def _allowlist(monkeypatch)
• test_mode_defaults_off_and_parses_aliases · function · L39-L47 — def test_mode_defaults_off_and_parses_aliases(monkeypatch)
• test_host_only_skill_constraint_never_grants · function · L50-L83 — def test_host_only_skill_constraint_never_grants(monkeypatch)
• _grant · function · L73-L75 — def _grant(domain: str) -> str
• test_off_mode_fails_open · function · L86-L90 — def test_off_mode_fails_open(monkeypatch): # unconfigured → networking stays fully ON; nothing is blocked
• test_allowlist_permits_science_and_package_domains · function · L94-L126 — def test_allowlist_permits_science_and_package_domains(monkeypatch)
• test_allowlist_suffix_match_covers_subdomains · function · L129-L135 — def test_allowlist_suffix_match_covers_subdomains(monkeypatch)
• test_allowlist_blocks_lookalikes_and_general_saas · function · L138-L146 — def test_allowlist_blocks_lookalikes_and_general_saas(monkeypatch)
• test_catalog_membership_is_mode_independent_and_preserves_exact_hosts · function · L149-L164 — def test_catalog_membership_is_mode_independent_and_preserves_exact_hosts(monkeypatch)
• test_an_unparseable_target_stays_fail_open_for_domain_allowed · function · L167-L184 — def test_an_unparseable_target_stays_fail_open_for_domain_allowed(monkeypatch)
• test_domain_of_parses_url_bare_and_port · function · L187-L191 — def test_domain_of_parses_url_bare_and_port(monkeypatch)
• test_check_url_raises_proxy_403 · function · L194-L203 — def test_check_url_raises_proxy_403(monkeypatch)
• test_blocked_error_is_single_key_soft_fail · function · L206-L210 — def test_blocked_error_is_single_key_soft_fail(monkeypatch)
• test_grant_widens_then_reset_narrows · function · L214-L228 — def test_grant_widens_then_reset_narrows(monkeypatch)
• test_scan_command_flags_only_blocked_urls · function · L232-L240 — def test_scan_command_flags_only_blocked_urls(monkeypatch)
• test_security_config_surface · function · L244-L253 — def test_security_config_surface(monkeypatch)
• test_config_default_off_is_non_breaking · function · L256-L258 — def test_config_default_off_is_non_breaking(monkeypatch)
• test_gateway_display_shares_single_source_of_truth · function · L261-L264 — def test_gateway_display_shares_single_source_of_truth()
• _dispatcher · function · L268-L276 — def _dispatcher(tmp_path)
• _wait_ask · function · L279-L285 — def _wait_ask(events)
• _kernel_local_host · function · L288-L312 — def _kernel_local_host()
• _no_rpc · function · L295-L296 — def _no_rpc(method, args)
• authorize · function · L302-L310 — def authorize(method, args)
• test_bash_blocked_domain_soft_fails_before_running · function · L315-L324 — def test_bash_blocked_domain_soft_fails_before_running(tmp_path, monkeypatch)
• test_bash_allowlisted_domain_is_not_fenced · function · L327-L334 — def test_bash_allowlisted_domain_is_not_fenced(tmp_path, monkeypatch)
• test_kernel_local_bash_sees_runtime_grants_via_host_verdict · function · L337-L366 — def test_kernel_local_bash_sees_runtime_grants_via_host_verdict(tmp_path, monkeypatch)
• test_web_fetch_blocked_returns_proxy_403_soft_fail · function · L369-L375 — def test_web_fetch_blocked_returns_proxy_403_soft_fail(tmp_path, monkeypatch)
• test_request_network_access_widens_via_broker · function · L378-L410 — def test_request_network_access_widens_via_broker(tmp_path, monkeypatch)
• test_request_network_access_denied_leaves_fence_closed · function · L413-L436 — def test_request_network_access_denied_leaves_fence_closed(tmp_path, monkeypatch)
• test_request_network_access_requires_a_domain · function · L439-L450 — def test_request_network_access_requires_a_domain(tmp_path, monkeypatch)
• test_sdk_facade_sends_request_network_access · function · L453-L465 — def test_sdk_facade_sends_request_network_access(monkeypatch): # the host.* facade wires the method name + args the dispatcher expects