fix(FN-4637): harden bubblewrap runner and extend coverage

Fusion-Task-Id: FN-4637
Fusion-Task-Lineage: 564c5692-3aaf-4396-9306-a395703cf365

packages/engine/src/__tests__/sandbox/bubblewrap-backend.test.ts

@@ -1,3 +1,4 @@
+import { execSync } from "node:child_process";
 import { cwd } from "node:process";
 
 import { beforeEach, describe, expect, it, vi } from "vitest";
@@ -11,6 +12,14 @@ vi.mock("../../sandbox/bubblewrap-detect.js", () => ({
 import { BubblewrapBackend, SandboxUnavailableError } from "../../sandbox/bubblewrap-backend.js";
 import type { SandboxBackend, SandboxRunResult } from "../../sandbox/types.js";
 
+const hasBwrap = (() => {
+  try {
+    return !!execSync("command -v bwrap", { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return false;
+  }
+})();
+
 describe("BubblewrapBackend", () => {
   beforeEach(() => {
     detectMock.mockReset();
@@ -70,4 +79,21 @@ describe("BubblewrapBackend", () => {
     expect(result).toHaveProperty("stdout");
     expect(result).toHaveProperty("stderr");
   });
+
+  it.skipIf(process.platform !== "linux" || !hasBwrap)("runs real bubblewrap hello integration", async () => {
+    vi.doUnmock("../../sandbox/bubblewrap-detect.js");
+    const { BubblewrapBackend: RealBackend } = await import("../../sandbox/bubblewrap-backend.js");
+    const backend = new RealBackend();
+    await backend.prepare({ allowNetwork: true });
+
+    const result = await backend.run("echo hello", {
+      cwd: cwd(),
+      timeoutMs: 5_000,
+      maxBuffer: 1024 * 1024,
+      encoding: "utf-8",
+    });
+
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.trim()).toBe("hello");
+  });
 });

packages/engine/src/__tests__/sandbox/bubblewrap-policy.test.ts

@@ -74,5 +74,8 @@ describe("policyToBwrapArgs", () => {
     expect(preset.allowedWritePaths).toContain("/repo/.worktrees/fn-1");
     expect(preset.allowedWritePaths).toContain("/home/u/.pnpm-store");
     expect((preset.allowedWritePaths ?? []).some((path) => path.includes(".fusion"))).toBe(false);
+
+    const args = policyToBwrapArgs(preset, baseCtx());
+    expect(args.join(" ")).not.toContain(".fusion/fusion.db");
   });
 });