Testing & Test Series

Test Series

Aartiq's core modules are verified with an automated Jest test suite. This page reports the real numbers, what is covered, and — honestly — what is not.

16

Test Suites

525

Total Tests

514

Passing

11

Platform-skipped · 0 failing

Breakdown

Test Suites

Suite	Tests	What it verifies
sandbox-security.test.js	60	Fail-closed sandboxing (Seatbelt / bubblewrap / Job Objects), macOS adversarial OS-enforcement, command tokenizer, env sanitization
windows-job-sandbox.test.js	10	Windows Job Object JS contract + runtime matrix (suspended start, verified job assignment, grandchild containment, secret isolation, KILL_ON_JOB_CLOSE)
linux-bwrap-sandbox.test.js	14	bubblewrap arg generation, namespace/unshare flags, capability pre-flight fail-closed, Linux runtime enforcement
security-fixes.test.js	40	Regression suite for applied security fixes
security-validator.test.js	42	Blocklist / injection detection / risk classification
directory-allowlist.test.js	36	Path canonicalization, symlink traversal, read/write separation
approval-ticket-security.test.js	21	Ticket-based approval + capability-controller regression (audit findings)
skill-loading.test.js	54	Dynamic skill loading, validation allowlist, require-path resolution
extraction.test.js	58	Web extractor, DOM parsing, content extraction edge cases
tab-intelligence.test.ts	51	Tab intelligence, domain grouping, smart icons
dom-engine.test.js	40	DOM interaction engine, click/fill strategies
component-tests.test.js	37	React component behavior and props
webauthn-service.test.js	26	WebAuthn / FIDO2 challenge-response flow
automation.test.js	16	OS automation layer (click / scroll / app launch)
dom-handlers.test.js	16	Browser DOM IPC handlers
home-intelligence.test.ts	4	Home intelligence logic

Coverage

What's Covered

Fail-closed by construction: every sandbox setup, validation, or policy failure returns a structured SANDBOX_* error and the command is never silently run unsandboxed — there is no automatic fallback path
macOS Seatbelt — real OS enforcement: writing outside the directory allowlist is denied by the kernel and the file is verified absent; reading a secret outside the allowlist is denied; /tmp is writable; a network bind is denied; reading/writing through a symlink that escapes the allowlist is denied; a child process spawned by the target is still contained
Linux bubblewrap — closed-by-default namespaces (pid/net/ipc/uts), correct --bind (write) vs --ro-bind (read-only) mapping, network denied by default, and fail-closed when bwrap is missing OR present-but-incapable of creating the required namespaces (the new capability pre-flight)
Windows Job Object containment — policy fail-closed (a per-process network policy is rejected as SANDBOX_UNAVAILABLE), missing-runner fail-closed, result parsing, explicit isolation flags ({ filesystem:false, network:false, process:true }), and a runtime matrix proving suspended start + verified job assignment + grandchild containment + secret isolation + KILL_ON_JOB_CLOSE
Explicit isolation contract — every result carries { filesystem, network, process } so callers cannot mistake process containment for filesystem/network isolation; Windows reports process-only, macOS/Linux report all true, and any setup failure reports all false
Directory allowlist — fs.realpath() canonicalization, ../ traversal, symlink escape, read-only vs read-write separation, and invalid/missing-path rejection (never silently skipped)
Command execution — the tokenizer preserves quoted arguments verbatim, separates direct execution from explicit shell mode, and never reconstructs a command via a string-joined sh -c; it is documented as a classifier, not a security parser
Environment sanitization — API keys, tokens, and secrets are stripped from every sandboxed process; only an allowlisted set of non-credential variables passes through
Security regressions — a 40-test regression suite re-verifying each applied security fix, plus approval-ticket tests that lock in the audit remediation

Honesty First

Known Limits

What this suite does NOT prove

We would rather state these limits plainly than overstate coverage.

Windows and Linux runtime enforcement tests are real test files, but they only EXECUTE on their own OS: the Windows matrix runs on windows-latest CI, the Linux matrix on Linux hosts with bwrap installed. On macOS they are collected but skipped — their JS-contract portions still run everywhere.
macOS Seatbelt OS-enforcement tests execute only on macOS; they ran and passed on this machine. The profile-generation and fail-closed config paths are asserted on every platform.
These are unit and integration tests for core modules. They do NOT cover the full Electron UI, installers, MSIX/MSI packaging, or complete end-to-end user flows.
A sandbox confines what code can do; it is not a proof that the AI's decisions are safe, nor a substitute for least-privilege OS accounts, patched dependencies, or simply not running untrusted code. See the security page's 'What this does NOT guarantee'.
Test counts reflect the repository state at the time this page was generated (525 tests across 16 suites; 514 passing, 11 platform-skipped, 0 failing). Always run npx jest to get current numbers.

Reproduce

Run the Tests

Install

cd aartiq-browser
npm install

Run full suite

npx jest

Run one suite

npx jest tests/sandbox-security.test.js

View Test Sources Security Model