test(e2e): prove managed exec egress denial

src/lib/actions/sandbox/connect-inference-route-probe.ts

@@ -48,7 +48,7 @@ export const INFERENCE_ROUTE_PROBE_SCRIPT = [
 // This separate regular-file install is intentionally absent from older images:
 // a newer CLI probing one fails before the stateful entrypoint or dcode wrapper
 // can run, so version skew cannot mutate observability state.
-const DCODE_MANAGED_RUNTIME_LAUNCHER = "/usr/local/lib/nemoclaw/dcode-managed-exec";
+const DCODE_MANAGED_EXEC_LAUNCHER = "/usr/local/lib/nemoclaw/dcode-managed-exec";
 
 /**
  * Classify a route result that is already known not to be healthy.
@@ -69,7 +69,7 @@ export function buildSandboxInferenceRouteProbeArgs(
           // The trusted launcher ignores ambient proxy overrides and does not
           // source sandbox-user startup files or rewrite persistent runtime
           // state before executing this probe.
-          DCODE_MANAGED_RUNTIME_LAUNCHER,
+          DCODE_MANAGED_EXEC_LAUNCHER,
           "/bin/sh",
           "-c",
           INFERENCE_ROUTE_PROBE_SCRIPT,

test/e2e/e2e-cloud-experimental/checks/06-deepagents-code-python-egress.sh

@@ -18,6 +18,7 @@ DCODE_CANONICAL_PATH="/usr/local/bin:/opt/venv/bin:/usr/local/sbin:/usr/sbin:/us
 PROJECT_VENV="/sandbox/.nemoclaw-e2e-project-venv"
 PROJECT_PYTHON="${PROJECT_VENV}/bin/python3"
 PROJECT_PIP="${PROJECT_VENV}/bin/pip3"
+DCODE_MANAGED_EXEC="/usr/local/lib/nemoclaw/dcode-managed-exec"
 
 ok() { printf '%s\n' "${PREFIX}: OK ($*)"; }
 info() { printf '%s\n' "${PREFIX}: $*"; }
@@ -94,13 +95,15 @@ PY
 python_probe() {
   local python_bin="$1"
   local url="$2"
+  local -a command_prefix=("${@:3}")
   local encoded remote_cmd
   if [ -n "${NEMOCLAW_E2E_PYTHON_PROBE_FIXTURE+x}" ]; then
     printf '%s\n' "$NEMOCLAW_E2E_PYTHON_PROBE_FIXTURE"
     return 0
   fi
   encoded="$(python_probe_source | base64 | tr -d '\n')"
-  remote_cmd="${python_bin@Q} -c \"\$(printf '%s' ${encoded@Q} | base64 -d)\" ${url@Q}"
+  printf -v remote_cmd '%q ' "${command_prefix[@]}" "$python_bin"
+  remote_cmd+="-c \"\$(printf '%s' ${encoded@Q} | base64 -d)\" ${url@Q}"
   sandbox_exec "$remote_cmd"
 }
 
@@ -123,8 +126,9 @@ expect_blocked() {
   local label="$2"
   local url="$3"
   local python_bin="${4:-python3}"
+  local -a command_prefix=("${@:5}")
   local output
-  output="$(python_probe "$python_bin" "$url" || true)"
+  output="$(python_probe "$python_bin" "$url" "${command_prefix[@]}" || true)"
   if echo "$output" | grep -q "BLOCKED:" && ! echo "$output" | grep -q "REACHED:"; then
     pass "${actor} cannot reach ${label} without explicit policy"
   elif echo "$output" | grep -q "REACHED:"; then
@@ -152,12 +156,13 @@ if [ "${NEMOCLAW_E2E_PYTHON_EGRESS_SELF_TEST:-}" = "probe-command-shape" ]; then
         return 1
         ;;
       *)
-        printf '%s\n' "NO_NEWLINE_IN_COMMAND"
+        printf 'SINGLE_LINE_COMMAND:%s\n' "$1"
         return 0
         ;;
     esac
   }
   python_probe "python3" "https://example.com/"
+  python_probe "/opt/venv/bin/python3" "https://example.com/" "$DCODE_MANAGED_EXEC"
   exit 0
 fi
 
@@ -189,6 +194,14 @@ fi
 expect_reached "arbitrary Python" "GitHub" "https://api.github.com/"
 expect_reached "arbitrary Python" "PyPI" "https://pypi.org/"
 expect_blocked "arbitrary Python" "Tavily" "https://api.tavily.com/"
+# The public helper only reconstructs the trusted proxy environment; OpenShell
+# must still enforce Tavily denial on the final managed-Python executable.
+expect_blocked \
+  "direct managed-exec Python" \
+  "Tavily" \
+  "https://api.tavily.com/" \
+  "/opt/venv/bin/python3" \
+  "$DCODE_MANAGED_EXEC"
 expect_blocked "arbitrary Python" "LangSmith" "https://api.smith.langchain.com/"
 expect_blocked "arbitrary Python" "MCP hosts" "https://modelcontextprotocol.io/"
 expect_blocked "arbitrary Python" "unapproved hosts" "https://example.com/"

test/e2e/support/platform-parity-cloud-experimental.test.ts

@@ -238,7 +238,7 @@ describe("P0-E cloud-experimental parity guardrails", () => {
     );
   });
 
-  it("keeps Deep Agents Python egress probe command single-line for OpenShell exec", () => {
+  it("keeps Deep Agents Python egress probe commands single-line for OpenShell exec", () => {
     const result = spawnSync(
       "bash",
       [
@@ -257,7 +257,12 @@ describe("P0-E cloud-experimental parity guardrails", () => {
     );
 
     expect(result.status).toBe(0);
-    expect(result.stdout.trim()).toBe("NO_NEWLINE_IN_COMMAND");
+    const commands = result.stdout.trim().split("\n");
+    expect(commands).toHaveLength(2);
+    expect(commands[0]).toMatch(/^SINGLE_LINE_COMMAND:python3 -c /);
+    expect(commands[1]).toMatch(
+      /^SINGLE_LINE_COMMAND:\/usr\/local\/lib\/nemoclaw\/dcode-managed-exec \/opt\/venv\/bin\/python3 -c /,
+    );
   });
 
   it("keeps Deep Agents secret-boundary probe command single-line for OpenShell exec", () => {

test/langchain-deepagents-code-image.test.ts

@@ -479,12 +479,17 @@ describe("LangChain Deep Agents Code image contracts", () => {
       "ERROR:URLError",
       "lacked denial evidence",
       "python_probe_source",
+      'DCODE_MANAGED_EXEC="/usr/local/lib/nemoclaw/dcode-managed-exec"',
+      'local -a command_prefix=("${@:3}")',
+      "printf -v remote_cmd '%q '",
       "base64 | tr -d",
       "base64 -d",
-      "${python_bin@Q} -c",
+      'remote_cmd+="-c',
       "${url@Q}",
       'expect_reached "arbitrary Python" "GitHub" "https://api.github.com/"',
       'expect_reached "arbitrary Python" "PyPI" "https://pypi.org/"',
+      '"direct managed-exec Python"',
+      '"/opt/venv/bin/python3"',
       'PROJECT_VENV="/sandbox/.nemoclaw-e2e-project-venv"',
       "python3 -m venv --copies",
       'expect_reached "project venv Python under /sandbox" "PyPI" "https://pypi.org/" "$PROJECT_PYTHON"',