Turn off Winboat container and do some sandboxing

tests/sandbox.bats

@@ -37,3 +37,50 @@ exec "$@"'
   [ "$status" -eq 0 ]
   jq -e '.network.allowedDomains | index("llm.local:11434") and index("github.com")' "$SETTINGS_COPY"
 }
+
+# --- configure sandbox ----------------------------------------------------------------
+
+setup_configure() {
+  export COREDESKTOP="$REPO"
+  confirm() { return 0; }
+  source "$REPO/configure.d/65-sandbox.sh"
+}
+
+@test "the sandbox hides WinBoat's settings by default" {
+  jq -e '.filesystem.denyRead | index("~/.winboat")' "$REPO/sandbox/config/base.json"
+  run "$SANDBOX/bin/fakeagent"
+  [ "$status" -eq 0 ]
+  jq -e '.filesystem.denyRead | index("~/.winboat")' "$SETTINGS_COPY"
+  run jq -e '.filesystem.allowRead | index("~/.winboat")' "$SETTINGS_COPY"
+  [ "$status" -ne 0 ]
+}
+
+@test "configure sandbox lets agents read WinBoat's settings, and hides them again" {
+  setup_configure
+  mkdir -p "$HOME/.config/coredesktop/sandbox"
+  echo '{"network": {"allowedDomains": ["llm.local:11434"]}}' > "$SANDBOX_CONF"
+
+  run run_configure <<< $'1\nq'
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Agents can read ~/.winboat."* ]]
+  [ "$(jq -c '.filesystem.allowRead' "$SANDBOX_CONF")" = '["~/.winboat"]' ]
+  [ "$(jq -c '.network.allowedDomains' "$SANDBOX_CONF")" = '["llm.local:11434"]' ]
+
+  # What the agent gets: still denied, but re-allowed, which srt lets win
+  run "$SANDBOX/bin/fakeagent"
+  jq -e '(.filesystem.denyRead | index("~/.winboat")) and (.filesystem.allowRead | index("~/.winboat"))' "$SETTINGS_COPY"
+
+  run run_configure <<< $'1\nq'
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"~/.winboat is hidden from agents again."* ]]
+  [ "$(jq -c '.filesystem.allowRead' "$SANDBOX_CONF")" = '[]' ]
+}
+
+@test "configure sandbox is offered only where WinBoat is set up, and is never to do" {
+  setup_configure
+  run is_installed
+  [ "$status" -ne 0 ]
+  mkdir -p "$HOME/.winboat"
+  is_installed
+  is_configured
+}

tests/winboat.bats

@@ -0,0 +1,75 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+# system/winboat.sh with a WinBoat compose file and fake docker and podman.
+# $POLICY is the container's restart policy; empty means there's no container.
+
+setup() {
+  common_setup
+  WINBOAT="$HOME/.winboat"
+  COMPOSE="$WINBOAT/docker-compose.yml"
+  mkdir -p "$WINBOAT"
+  export POLICY=no
+  stub docker '[ "$1" = inspect ] && { [ -n "$POLICY" ] || exit 1; echo "$POLICY"; }; exit 0'
+  stub podman '[ "$1" = inspect ] && { [ -n "$POLICY" ] || exit 1; echo "$POLICY"; }; exit 0'
+}
+
+# compose RESTART: a compose file like WinBoat's with that restart line
+compose() {
+  printf 'services:\n  windows:\n    container_name: WinBoat\n    stop_grace_period: 120s\n    restart: %s\n    privileged: true\n' "$1" > "$COMPOSE"
+}
+
+@test "winboat.sh does nothing before WinBoat is set up" {
+  rmdir "$WINBOAT"
+  run bash "$REPO/system/winboat.sh"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+  not_called docker
+}
+
+@test "winboat.sh changes nothing when Auto Start Container is off" {
+  compose no
+  cp "$COMPOSE" "$BATS_TEST_TMPDIR/before"
+  run bash "$REPO/system/winboat.sh"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+  cmp "$COMPOSE" "$BATS_TEST_TMPDIR/before"
+  uncalled docker update --restart=no WinBoat
+}
+
+@test "winboat.sh turns Auto Start Container off in the compose file and on the container" {
+  compose unless-stopped
+  export POLICY=unless-stopped
+  run bash "$REPO/system/winboat.sh"
+  [ "$status" -eq 0 ]
+  grep -qx '    restart: no' "$COMPOSE"
+  grep -qx '    privileged: true' "$COMPOSE"
+  called docker update --restart=no WinBoat
+}
+
+@test "winboat.sh accepts a quoted \"no\"" {
+  compose '"no"'
+  run bash "$REPO/system/winboat.sh"
+  [ "$status" -eq 0 ]
+  grep -qx '    restart: "no"' "$COMPOSE"
+}
+
+@test "winboat.sh fixes the compose file when the container doesn't exist" {
+  compose always
+  export POLICY=""
+  run bash "$REPO/system/winboat.sh"
+  [ "$status" -eq 0 ]
+  grep -qx '    restart: no' "$COMPOSE"
+  uncalled docker update --restart=no WinBoat
+}
+
+@test "winboat.sh uses Podman when WinBoat does" {
+  compose always
+  echo '{"containerRuntime": "Podman"}' > "$WINBOAT/winboat.config.json"
+  export POLICY=always
+  run bash "$REPO/system/winboat.sh"
+  [ "$status" -eq 0 ]
+  called podman update --restart=no WinBoat
+  not_called docker
+}