Problem
--sandbox has 9 acceptance tests, and none covers either boundary the docs draw:
- A child process cannot resolve an unmocked command.
sh -c 'command -v bashunit_sandbox_probe' returns empty under --sandbox: the narrowed PATH is inherited, so the command is unreachable rather than merely unreported. This is what makes sh -c 'curl …' useless as an escape off Windows, and docs/test-doubles.md says so by implication ("On Windows … is not blocked either").
- An absolute path bypasses the sandbox. Documented as a limitation, and nothing keeps it a deliberate one.
Both are security-adjacent properties of a feature whose whole purpose is constraining a test's reach, and both would regress silently.
What the mutation testing showed
The child-process property does not depend on what it looks like it depends on. Removing export PATH from src/runner/sandbox.sh changes nothing — PATH is exported already, so that mutation is a no-op and every test still passes.
It holds because the sandbox replaces PATH rather than prepending to it. Mutating
PATH="$_BASHUNIT_SANDBOX_DIR" -> PATH="$_BASHUNIT_SANDBOX_DIR:$PATH"
fails the new child-process test and nothing else.
Proposal
Two acceptance tests plus their fixture entries, with the verified mechanism recorded in the comment — including which mutation proves it and which one looks like it should but does not. A comment naming the wrong dependency is worse than none: the next person mutates what it names, sees green, and concludes the test is worthless.
Problem
--sandboxhas 9 acceptance tests, and none covers either boundary the docs draw:sh -c 'command -v bashunit_sandbox_probe'returns empty under--sandbox: the narrowed PATH is inherited, so the command is unreachable rather than merely unreported. This is what makessh -c 'curl …'useless as an escape off Windows, anddocs/test-doubles.mdsays so by implication ("On Windows … is not blocked either").Both are security-adjacent properties of a feature whose whole purpose is constraining a test's reach, and both would regress silently.
What the mutation testing showed
The child-process property does not depend on what it looks like it depends on. Removing
export PATHfromsrc/runner/sandbox.shchanges nothing —PATHis exported already, so that mutation is a no-op and every test still passes.It holds because the sandbox replaces PATH rather than prepending to it. Mutating
fails the new child-process test and nothing else.
Proposal
Two acceptance tests plus their fixture entries, with the verified mechanism recorded in the comment — including which mutation proves it and which one looks like it should but does not. A comment naming the wrong dependency is worse than none: the next person mutates what it names, sees green, and concludes the test is worthless.