test(sandbox): comprehensive test suite for exploit_sandbox module (+76 tests)

[manus-use]

Summary

Comprehensive test suite for the manus_agent.sandbox.exploit_sandbox module — 76 fully-mocked tests covering the entire ExploitSandbox class and all module-level helper functions.

What's tested

ExploitSandbox class

• __init__ — default params, custom params, unique UIDs across instances
• _labels — role tagging structure for all resource types
• build_target — image build via docker_retry, build log collection (stream filtering), error propagation
• start_target — network creation, container creation, network connect with alias, container start, wait_for_container_running, environment passing
• wait_for_target — success on first probe, timeout (deadline exceeded), transient Docker error retry loop, non-transient error propagation
• run_exploit — container creation on isolated network, code copy, interpreter resolution, exec execution, environment merging (TARGET_HOST + custom), None output handling, fallback interpreter reporting, non-zero exit codes
• run_local_exploit — target-not-running guard, execution inside target container, env passing, None env default
• get_target_logs — success, exception swallowing, no container, non-UTF-8 bytes
• get_target_exit_code — success, non-zero exit, reload exception, missing State key, no container
• get_docker_ps_all — success with tags, without tags (short_id fallback), list exception, per-container reload exception, no client
• cleanup — full teardown (all resources), partial state, client close error handling, no client

Helper functions

• _copy_to_container — tar archive creation, put_archive call, binary data, nested paths
• _file_extension — python/bash/sh/unknown/case-insensitive
• _execution_command — all languages + unknown default + case-insensitive
• _interpreter_candidates — python (python3 first), bash, sh, unknown, case-insensitive, empty string
• _resolve_interpreter — first candidate found, fallback candidate, empty candidates error, exec failure error, exit code 127, unexpected stdout, single candidate

Integration lifecycle tests

• Build → start → run_exploit → cleanup (full remote exploit flow)
• Build → start → run_local_exploit → cleanup (local privilege escalation flow)

Test characteristics

• 100% mocked — no real Docker daemon, no network calls
• Zero regressions — full suite passes: 1234 tests (1158 baseline + 76 new), 0 failures
• Lint clean — ruff check . passes with no warnings

Overlap check

Confirmed no duplicate by reviewing all open PRs:

• test(utils): comprehensive test suite for docker_client module (+84 tests) #142 tests utils/docker_client.py (different module — Docker utility functions)
• test(sandbox): comprehensive test suite for docker_sandbox module (+69 tests) #143 tests sandbox/docker_sandbox.py (different module — general code execution sandbox)
• test(tools): comprehensive test suite for code_execute module (+45 tests) #141 tests tools/code_execute.py (higher-level tool, mocks ExploitSandbox)
• test(tools): comprehensive test suite for submit_cves, tool_output_logger, and verify_exploit helpers #93 tests tools/submit_cves.py and verify_exploit.py (tool-level, uses FakeSandbox)
• test(core-tools): comprehensive test suite for check_cisa_kev, get_nvd_data, get_cwe_details, get_otx_cve_details #89, test(tools): comprehensive test suite for search_exploit_db, search_packetstorm, query_threat_intelligence_feeds, obtain_cves #90, test(cli): comprehensive test suite for manus-agent osv subcommand + README docs #120-tests: comprehensive CLI tests for _run_analyze, _run_remediate, _run_discover (+78 tests) #123, test(cli): comprehensive test suite for manus-agent history subcommand (+39 tests) #132, test(tools): comprehensive test suite for track_vendor_response (+67 tests) #137, test(cli): comprehensive test suite for manus-agent poc-search subcommand (+57 tests) #139, test(tools): comprehensive test suite for http_request truncation wrapper (+36 tests) #140 — all test different modules

No existing open or merged PR provides dedicated tests for sandbox/exploit_sandbox.py.