From 34245c73f18ea4dadbe7d772f52b3d9fe0a36b17 Mon Sep 17 00:00:00 2001
From: peteryuqin <peter.yuqin@gmail.com>
Date: Mon, 16 Mar 2026 23:57:51 -0400
Subject: [PATCH] fix: change const to let for policy reassignment and add
 helper tests

applyPreset() crashes with "Assignment to constant variable" when a
sandbox has a policy without a network_policies section. Change the
declaration from const to let so the fallback path can prepend the
version field.

Also export extractPresetEntries and parseCurrentPolicy for testing
and add 9 unit tests covering all three pure helpers.

Signed-off-by: Peter Tam <nickthetam@gmail.com>
Signed-off-by: peteryuqin <peter.yuqin@gmail.com>
---
 bin/lib/policies.js           |  4 +-
 test/policies-helpers.test.js | 96 +++++++++++++++++++++++++++++++++++
 2 files changed, 99 insertions(+), 1 deletion(-)
 create mode 100644 test/policies-helpers.test.js

diff --git a/bin/lib/policies.js b/bin/lib/policies.js
index 575fcdee27d..b676b58f816 100644
--- a/bin/lib/policies.js
+++ b/bin/lib/policies.js
@@ -91,7 +91,7 @@ function applyPreset(sandboxName, presetName) {
     );
   } catch {}
 
-  const currentPolicy = parseCurrentPolicy(rawPolicy);
+  let currentPolicy = parseCurrentPolicy(rawPolicy);
 
   // Merge: inject preset entries under the existing network_policies key
   let merged;
@@ -175,6 +175,8 @@ module.exports = {
   listPresets,
   loadPreset,
   getPresetEndpoints,
+  extractPresetEntries,
+  parseCurrentPolicy,
   applyPreset,
   getAppliedPresets,
 };
diff --git a/test/policies-helpers.test.js b/test/policies-helpers.test.js
new file mode 100644
index 00000000000..0b23d9ede3f
--- /dev/null
+++ b/test/policies-helpers.test.js
@@ -0,0 +1,96 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+const { describe, it } = require("node:test");
+const assert = require("node:assert/strict");
+
+const {
+  getPresetEndpoints,
+  extractPresetEntries,
+  parseCurrentPolicy,
+} = require("../bin/lib/policies");
+
+describe("getPresetEndpoints", () => {
+  it("extracts hosts from YAML content", () => {
+    const content = `
+network_policies:
+  npm_yarn:
+    endpoints:
+      - host: registry.npmjs.org
+        port: 443
+      - host: registry.yarnpkg.com
+        port: 443
+`;
+    const hosts = getPresetEndpoints(content);
+    assert.deepEqual(hosts, ["registry.npmjs.org", "registry.yarnpkg.com"]);
+  });
+
+  it("returns empty array when no hosts found", () => {
+    assert.deepEqual(getPresetEndpoints(""), []);
+    assert.deepEqual(getPresetEndpoints("name: foo"), []);
+  });
+
+  it("extracts single host", () => {
+    const content = "host: example.com";
+    assert.deepEqual(getPresetEndpoints(content), ["example.com"]);
+  });
+});
+
+describe("extractPresetEntries", () => {
+  it("extracts content after network_policies key", () => {
+    const content = `preset:
+  name: npm
+  description: "npm access"
+
+network_policies:
+  npm_yarn:
+    name: npm_yarn
+    endpoints:
+      - host: registry.npmjs.org
+`;
+    const result = extractPresetEntries(content);
+    assert.ok(result);
+    assert.ok(result.includes("npm_yarn"));
+    assert.ok(result.includes("registry.npmjs.org"));
+  });
+
+  it("returns null when no network_policies section", () => {
+    const content = `preset:
+  name: test
+  description: "no policies"
+`;
+    assert.equal(extractPresetEntries(content), null);
+  });
+
+  it("returns null for empty string", () => {
+    assert.equal(extractPresetEntries(""), null);
+  });
+});
+
+describe("parseCurrentPolicy", () => {
+  it("strips metadata header before ---", () => {
+    const raw = `Version: 3
+Hash: abc123
+---
+version: 1
+
+network_policies:
+  claude_code:
+    name: claude_code`;
+    const result = parseCurrentPolicy(raw);
+    assert.ok(result.startsWith("version: 1"));
+    assert.ok(result.includes("claude_code"));
+    assert.ok(!result.includes("Hash:"));
+  });
+
+  it("returns content as-is when no --- separator", () => {
+    const raw = "version: 1\nnetwork_policies:";
+    assert.equal(parseCurrentPolicy(raw), raw);
+  });
+
+  it("returns empty string for null/empty input", () => {
+    assert.equal(parseCurrentPolicy(""), "");
+    assert.equal(parseCurrentPolicy(null), "");
+    assert.equal(parseCurrentPolicy(undefined), "");
+  });
+});