test(code-runtime): complete sandboxed process coverage and catalogs

packages/experimental/code-runtime-python/tests/runtime.spec.ts

@@ -104,6 +104,27 @@ describe('PythonCodeRuntime — seam descriptors and misuse', () => {
     expect(runtime.isolation).toBe('process')
   })
 
+  it('resolves its configured deadline and cwd while refusing unsupported execution choices', async () => {
+    const { runtime, fiber } = await setup({ maxWallMs: 30_000 })
+    try {
+      const request = { program: 'return 1', bindings: [] }
+      expect(runtime.sandboxMode).toBeUndefined()
+      expect(runtime.resolve(request)).toEqual({ ...request, cwd: process.cwd(), timeoutMs: 30_000 })
+      const cwd = await makeTempDir('dsh-py-resolved-cwd-')
+      const spec = runtime.resolve({ ...request, cwd })
+      expect(spec.cwd).toBe(cwd)
+      expect(() => runtime.resolve({ ...request, cwd: 'relative' })).toThrow('cwd must be absolute')
+      expect(() => runtime.resolve({ ...request, timeoutMs: 1 })).toThrow('per-call timeout is unsupported')
+      const sandboxPolicy = { mode: 'danger-full-access' as const, workspaceRoot: cwd }
+      expect(() => runtime.resolve({ ...request, sandboxPolicy })).toThrow('sandbox policy is unsupported')
+      await expect(runtime.run({ ...spec, sandboxPolicy })).rejects.toThrow('unsupported execution policy or timeout')
+      await expect(runtime.run({ ...spec, timeoutMs: 1 })).rejects.toThrow('unsupported execution policy or timeout')
+      const result = await runtime.run(runtime.resolve({ ...request, cwd, program: 'import os\nreturn os.getcwd()' }))
+      expect(result.error).toBeUndefined()
+      expect(result.value).toBe(realpathSync(cwd))
+    } finally { await fiber.dispose() }
+  })
+
   it('rejects non-positive config as seam misuse', async () => {
     const ctx = new Context()
     await expect(ctx.plugin(PythonCodeRuntime, { cpuSeconds: 0 }))