praetorian-inc
diff --git a/‎pkg/crawl/browser.go‎
Lines changed: 16 additions & 3 deletions b/‎pkg/crawl/browser.go‎
Lines changed: 16 additions & 3 deletions
diff --git a/‎pkg/crawl/browser_test.go‎
Lines changed: 47 additions & 7 deletions b/‎pkg/crawl/browser_test.go‎
Lines changed: 47 additions & 7 deletions
@@ -57,14 +57,27 @@ type BrowserManager struct {
 	cleanupOnce sync.Once
 }
 
+// vespasianEnablesNoSandbox reports whether Vespasian's own configuration opts
+// into disabling Chrome's OS-level sandbox — either explicitly via
+// BrowserOptions.NoSandbox or via the VESPASIAN_NO_SANDBOX env var (set by CI
+// workflows). It is the single source of truth for that decision; both
+// configureLauncher and browser_test.go consult it. Keeping the decision in a
+// self-contained helper lets the test assert Vespasian's contribution
+// directly, which stays deterministic even where go-rod's launcher.New() adds
+// --no-sandbox by default in containers and masks the launcher-observed flag
+// (LAB-4994).
+func vespasianEnablesNoSandbox(opts BrowserOptions) bool {
+	return opts.NoSandbox || os.Getenv("VESPASIAN_NO_SANDBOX") == "true"
+}
+
 // configureLauncher applies BrowserOptions to a new launcher without
-// launching Chrome. Disables the sandbox when opts.NoSandbox is set or
-// when the VESPASIAN_NO_SANDBOX env var is "true" (set by CI workflows).
+// launching Chrome. Disables the sandbox when vespasianEnablesNoSandbox opts
+// in (see its doc for the exact condition).
 func configureLauncher(opts BrowserOptions) (*launcher.Launcher, error) {
 	l := launcher.New().
 		Headless(opts.Headless)
 
-	if opts.NoSandbox || os.Getenv("VESPASIAN_NO_SANDBOX") == "true" {
+	if vespasianEnablesNoSandbox(opts) {
 		l = l.NoSandbox(true)
 	}
 	if opts.ChromePath != "" {
 
@@ -17,6 +17,8 @@ package crawl
 import (
 	"strings"
 	"testing"
+
+	"github.com/go-rod/rod/lib/launcher"
 )
 
 // TEST-001 regression: SetCookies on a BrowserManager whose browser field
@@ -54,11 +56,23 @@ func TestBrowserManager_SetCookies_NilReceiverReturnsError(t *testing.T) {
 
 func TestConfigureLauncher(t *testing.T) {
 	t.Run("sandbox", func(t *testing.T) {
+		// go-rod's launcher.New() adds --no-sandbox by default when it
+		// detects a container (launcher sets defaultFlags[NoSandbox] when
+		// inContainer), so l.Has("no-sandbox") reflects that default in
+		// Docker/dev-containers regardless of Vespasian's own logic. Assert
+		// on Vespasian's *contribution* relative to this baseline instead of
+		// the absolute flag: the flag must be present whenever
+		// configureLauncher opts in, and otherwise must match the launcher
+		// default (Vespasian must not add it on its own). This stays
+		// deterministic on CI's VM runner (no container -> baseline absent)
+		// and in dev-containers (baseline present) for both uid 0 and uid != 0.
+		baselineNoSandbox := launcher.New().Has("no-sandbox")
+
 		tests := []struct {
-			name      string
-			noSandbox bool
-			envVal    string
-			wantFlag  bool
+			name        string
+			noSandbox   bool
+			envVal      string
+			vespasianOn bool // whether configureLauncher itself enables no-sandbox
 		}{
 			{"explicit NoSandbox", true, "", true},
 			{"explicit NoSandbox with env", true, "true", true},
@@ -70,13 +84,39 @@ func TestConfigureLauncher(t *testing.T) {
 		for _, tt := range tests {
 			t.Run(tt.name, func(t *testing.T) {
 				t.Setenv("VESPASIAN_NO_SANDBOX", tt.envVal)
-				l, err := configureLauncher(BrowserOptions{NoSandbox: tt.noSandbox})
+
+				// Assert Vespasian's own opt-in decision directly via the
+				// self-contained helper. Unlike the launcher-baseline check
+				// below, this does not observe go-rod's container default, so it
+				// stays deterministic in every environment: the negative cases
+				// still catch a regression that unconditionally enables the
+				// sandbox flag, even in dev-containers where launcher.New() adds
+				// --no-sandbox by default (LAB-4994).
+				opts := BrowserOptions{NoSandbox: tt.noSandbox}
+				if got := vespasianEnablesNoSandbox(opts); got != tt.vespasianOn {
+					t.Errorf("vespasianEnablesNoSandbox = %v, want %v", got, tt.vespasianOn)
+				}
+
+				l, err := configureLauncher(opts)
 				if err != nil {
 					t.Fatalf("unexpected error: %v", err)
 				}
+				// Launcher-baseline check, retained for go-rod compatibility:
+				// Vespasian forcing the flag on is authoritative; when it does
+				// not, the flag should equal the launcher's baseline default.
+				//
+				// Load-bearing assumption: this sub-assertion only exercises the
+				// configureLauncher wiring on a non-container runner, where
+				// baselineNoSandbox is false (e.g. CI's ubuntu-24.04 VM). In a
+				// container baselineNoSandbox is true, so want is unconditionally
+				// true and this check is vacuous — the environment-independent
+				// regression guard is the vespasianEnablesNoSandbox assertion
+				// above. If CI ever moves to a containerized runner, restore
+				// container-independent coverage of the configureLauncher wiring.
+				want := tt.vespasianOn || baselineNoSandbox
 				got := l.Has("no-sandbox")
-				if got != tt.wantFlag {
-					t.Errorf("Has(no-sandbox) = %v, want %v", got, tt.wantFlag)
+				if got != want {
+					t.Errorf("Has(no-sandbox) = %v, want %v (vespasianOn=%v, baseline=%v)", got, want, tt.vespasianOn, baselineNoSandbox)
 				}
 			})
 		}