From 44323ac115576a6437d63f84aa3e5cf0fa80e5e4 Mon Sep 17 00:00:00 2001
From: "Rai (Michael Pokorny)" <mpokorny@openai.com>
Date: Tue, 24 Jun 2025 22:18:11 -0700
Subject: [PATCH] agentydragon(tasks): sandbox agent launch for Task 15 with
 write-restricted Landlock sandbox and test script

---
 agentydragon/tasks/15-sandbox-test.sh | 40 +++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100755 agentydragon/tasks/15-sandbox-test.sh

diff --git a/agentydragon/tasks/15-sandbox-test.sh b/agentydragon/tasks/15-sandbox-test.sh
new file mode 100755
index 0000000000..1e9577ee66
--- /dev/null
+++ b/agentydragon/tasks/15-sandbox-test.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Test script for Task 15: verify sandbox restrictions and allowances
+set -euo pipefail
+
+# Determine worktree root (script is placed under agentydragon/tasks)
+worktree_root="$(cd "$(dirname "$0")"/.. && pwd)"
+
+echo "Running sandbox tests in worktree: $worktree_root"
+
+# Test write inside worktree
+echo -n "Test: write inside worktree... "
+if codex debug landlock --full-auto /usr/bin/env bash -c "touch '$worktree_root/inside_test'"; then
+  echo "PASS"
+else
+  echo "FAIL" >&2
+  exit 1
+fi
+
+# Test write inside TMPDIR
+tmpdir=${TMPDIR:-/tmp}
+echo -n "Test: write inside TMPDIR ($tmpdir)... "
+if codex debug landlock --full-auto /usr/bin/env bash -c "touch '$tmpdir/tmp_test'"; then
+  echo "PASS"
+else
+  echo "FAIL" >&2
+  exit 1
+fi
+
+# Prepare external directory under HOME to test outside worktree/TMPDIR
+external_dir="$HOME/sandbox_test_dir"
+mkdir -p "$external_dir"
+rm -f "$external_dir/outside_test"
+
+echo -n "Test: write outside allowed paths ($external_dir)... "
+if codex debug landlock --full-auto /usr/bin/env bash -c "touch '$external_dir/outside_test'"; then
+  echo "FAIL: outside write succeeded" >&2
+  exit 1
+else
+  echo "PASS"
+fi