Merge remote-tracking branch 'origin/benvin/go-launcher' into benvin/launch-dir-allowlist

# Conflicts:
#	main_test.go

go.mod

@@ -6,7 +6,6 @@ require (
 	github.com/containers/podman/v5 v5.8.4
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/opencontainers/runtime-spec v1.2.1
-	github.com/spf13/cobra v1.10.2
 	go.podman.io/common v0.67.1
 	golang.org/x/term v0.44.0
 )
@@ -52,7 +51,6 @@ require (
 	github.com/gorilla/schema v1.4.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.4.0 // indirect
@@ -92,6 +90,7 @@ require (
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
 	github.com/smallstep/pkcs7 v0.1.1 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
 	github.com/sylabs/sif/v2 v2.22.0 // indirect

main.go

@@ -17,7 +17,6 @@ import (
 	"github.com/containers/podman/v5/libpod/define"
 	"github.com/containers/podman/v5/pkg/specgen"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/spf13/cobra"
 	"go.podman.io/common/libnetwork/types"
 	"golang.org/x/term"
 )
@@ -36,23 +35,8 @@ func main() {
 	// A closed stdout must end the session through cleanup, not kill us.
 	signal.Ignore(syscall.SIGPIPE)
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
-	code := 0
-	root := &cobra.Command{
-		Use:                "agent-sandbox [--exec CMD...] [claude args...]",
-		Short:              "Run Claude Code in a rootless podman sandbox with allowlisted egress",
-		Args:               cobra.ArbitraryArgs,
-		DisableFlagParsing: true,
-		SilenceUsage:       true,
-		Run:                func(_ *cobra.Command, args []string) { code = launch(ctx, args) },
-	}
-	root.AddCommand(&cobra.Command{
-		Use:   "version",
-		Short: "Print the version",
-		Run:   func(*cobra.Command, []string) { fmt.Println(version) },
-	})
-	if err := root.Execute(); err != nil {
-		code = 1
-	}
+	// Every argument belongs to claude or --exec, as in the bash launcher.
+	code := launch(ctx, os.Args[1:])
 	stop()
 	os.Exit(code)
 }

main_test.go

@@ -579,3 +579,25 @@ func TestCheckLaunchDirRoots(t *testing.T) {
 		check(t, "invalid root "+bad, true, strings.Contains(fmt.Sprint(err), "allowed-paths"))
 	}
 }
+
+func TestLaunchPassesArgsVerbatim(t *testing.T) {
+	cases := []struct{ args, want []string }{
+		{[]string{"--exec", "podman", "version"}, []string{"podman", "version"}},
+		{[]string{"--exec", "sh", "-c", "x --y"}, []string{"sh", "-c", "x --y"}},
+		{[]string{"help"}, []string{"claude", "help"}},
+		{[]string{"version"}, []string{"claude", "version"}},
+		{[]string{"--resume", "abc"}, []string{"claude", "--resume", "abc"}},
+		{[]string{"-p", "hi"}, []string{"claude", "-p", "hi"}},
+		{[]string{"-p", "--exec", "help"}, []string{"claude", "-p", "--exec", "help"}},
+		{[]string{"--exec", "--exec"}, []string{"--exec"}},
+	}
+	for _, tc := range cases {
+		e := setup(t)
+		check(t, "exit", 0, e.launch(t, e.work+"/home/proj", tc.args...))
+		for name, s := range e.fake.specs {
+			if strings.HasSuffix(name, "-claude") {
+				check(t, strings.Join(tc.args, " "), tc.want, s.Command)
+			}
+		}
+	}
+}