Prove bubblewrap fallback and TypeScript symbol indexing in tests.

Empty PATH forces the honest Doctor unavailable path, and the symbol fixture covers Rust plus TypeScript definitions, references, and callers.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ShadowfetchStudio

native/core/src/sandbox.rs

@@ -277,4 +277,35 @@ mod tests {
         assert_eq!(report["ok"], false);
         assert_eq!(report["kernel_proof"], false);
     }
+
+    #[test]
+    fn missing_bubblewrap_reports_honest_fallback() {
+        let previous = std::env::var_os("PATH");
+        // Empty PATH: bwrap cannot be resolved even if installed on the host.
+        std::env::set_var("PATH", "");
+        let mode = detect();
+        let report = probe_workspace_cow();
+        let checks = doctor_checks();
+        match previous {
+            Some(value) => std::env::set_var("PATH", value),
+            None => std::env::remove_var("PATH"),
+        }
+        assert!(matches!(
+            mode,
+            SandboxMode::Off { reason } if reason.contains("bubblewrap")
+        ));
+        assert_eq!(report["shell_available"], false);
+        assert_eq!(report["mode"], "unavailable");
+        assert_eq!(report["kernel_proof"], false);
+        let bubble = checks
+            .iter()
+            .find(|c| c["id"] == "bubblewrap")
+            .expect("doctor includes bubblewrap");
+        assert_eq!(bubble["status"], "info");
+        assert!(bubble["detail"]
+            .as_str()
+            .unwrap_or("")
+            .to_ascii_lowercase()
+            .contains("bubblewrap"));
+    }
 }

native/core/src/symbol_index.rs

@@ -641,4 +641,26 @@ mod tests {
         assert!(status["storage"].as_str().unwrap().contains("private"));
         assert!(!root.path().join(".shadow").exists());
     }
+
+    #[test]
+    fn indexes_typescript_definitions_references_and_signatures() {
+        let root = tempfile::tempdir().unwrap();
+        let src = root.path().join("src");
+        fs::create_dir_all(&src).unwrap();
+        fs::write(
+            src.join("math.ts"),
+            "export function add(a: number, b: number): number { return a + b; }\nexport function useAdd() { return add(1, 2); }\n",
+        )
+        .unwrap();
+        let status = ensure_index(root.path(), &["src/math.ts".into()], false).unwrap();
+        assert!(status["symbols_total"].as_i64().unwrap() >= 2);
+        let defs = query_definitions(root.path(), "add", 10).unwrap();
+        assert!(!defs["definitions"].as_array().unwrap().is_empty());
+        let refs = query_references(root.path(), "add", 16).unwrap();
+        assert!(!refs["references"].as_array().unwrap().is_empty());
+        let sig = get_type_signature(root.path(), "add").unwrap();
+        assert!(sig["ok"].as_bool().unwrap());
+        let callers = callers_for(root.path(), "add", 8).unwrap();
+        assert!(callers["count"].as_u64().unwrap() >= 1);
+    }
 }

native/core/tests/flagship_complete.rs

@@ -119,9 +119,30 @@ fn sandbox_scratch_and_home_readonly_args() {
     assert!(args
         .windows(3)
         .any(|w| w[0] == "--bind" && w[2] == "/shadowcode-scratch"));
+    if std::path::Path::new("/home").exists() {
+        assert!(args
+            .windows(3)
+            .any(|w| w == ["--ro-bind", "/home", "/home"]));
+    }
+    assert!(args.iter().any(|a| a == "--unshare-net"));
     sandbox::discard_scratch(&scratch.path).unwrap();
     let cow = sandbox::probe_workspace_cow();
     assert_eq!(cow["kernel_proof"], false);
+    // Fallback: Doctor reports unavailable when bubblewrap cannot be found.
+    let previous = std::env::var_os("PATH");
+    std::env::set_var("PATH", "");
+    let fallback = sandbox::probe_workspace_cow();
+    let doctor = sandbox::doctor_checks();
+    match previous {
+        Some(value) => std::env::set_var("PATH", value),
+        None => std::env::remove_var("PATH"),
+    }
+    assert_eq!(fallback["mode"], "unavailable");
+    assert_eq!(fallback["shell_available"], false);
+    assert_eq!(
+        doctor.iter().find(|c| c["id"] == "bubblewrap").unwrap()["status"],
+        "info"
+    );
 }
 
 #[test]
@@ -134,12 +155,26 @@ fn symbol_index_fixture_tools() {
         "pub fn add(a: i32, b: i32) -> i32 { a + b }\npub fn use_add() { let _ = add(1, 2); }\n",
     )
     .unwrap();
-    let status = symbol_index::ensure_index(root.path(), &["src/lib.rs".into()], false).unwrap();
-    assert!(status["symbols_total"].as_i64().unwrap() >= 2);
+    fs::write(
+        src.join("math.ts"),
+        "export function mul(a: number, b: number): number { return a * b; }\nexport function useMul() { return mul(2, 3); }\n",
+    )
+    .unwrap();
+    let status = symbol_index::ensure_index(
+        root.path(),
+        &["src/lib.rs".into(), "src/math.ts".into()],
+        false,
+    )
+    .unwrap();
+    assert!(status["symbols_total"].as_i64().unwrap() >= 4);
     let sig = symbol_index::get_type_signature(root.path(), "add").unwrap();
     assert!(sig["ok"].as_bool().unwrap());
     let callers = symbol_index::callers_for(root.path(), "add", 8).unwrap();
     assert!(callers["count"].as_u64().unwrap() >= 1);
+    let ts_defs = symbol_index::query_definitions(root.path(), "mul", 8).unwrap();
+    assert!(!ts_defs["definitions"].as_array().unwrap().is_empty());
+    let ts_refs = symbol_index::query_references(root.path(), "mul", 16).unwrap();
+    assert!(!ts_refs["references"].as_array().unwrap().is_empty());
 }
 
 #[test]