test: add regression tests for Docker-in-Docker removal

[Copilot]

Add integration tests verifying Docker CLI and daemon are unavailable in agent containers after PR #205 removed Docker-in-Docker support.

Test Coverage

• docker command not found (which docker fails)
• docker run fails with "command not found" error
• docker-compose not installed
• Docker socket not mounted at /var/run/docker.sock

Implementation

Created tests/integration/no-docker.test.ts following existing test patterns:

test('docker command should not be available', async () => {
  const result = await runner.runWithSudo('which docker', {
    allowDomains: ['github.com'],
    logLevel: 'debug',
    timeout: 30000,
  });

  expect(result).toFail();
  expect(result.exitCode).not.toBe(0);
}, 120000);

Known Issue

Tests currently fail against pre-built registry images (ghcr.io/githubnext/gh-aw-firewall/agent:latest), which were built before PR #205 and still contain Docker CLI. Tests will pass once new images are published from commit 8d81fe4 or later.

Workaround: Use buildLocal: true test option (currently blocked by NodeSource Node.js 22 installation issues).

Verification

• Confirmed no existing integration tests depend on Docker-in-Docker functionality
• All 549 unit tests pass

Original prompt

Add regression tests for Docker-in-Docker removal

Task Description

Add integration tests to verify that Docker commands fail gracefully after Docker-in-Docker support was removed in v0.9.1 (PR #205).

Requirements

Create new test file: tests/integration/no-docker.test.ts

Test Cases

import { runAwf } from './helpers';

describe('Docker-in-Docker removal (PR #205)', () => {
  test('docker command should not be available', async () => {
    const result = await runAwf(
      ['--allow-domains', 'github.com'],
      'which docker'
    );
    
    expect(result.exitCode).not.toBe(0);
    // Should fail because docker-cli is not installed
  });

  test('docker run should fail gracefully', async () => {
    const result = await runAwf(
      ['--allow-domains', 'github.com'],
      'docker run alpine echo hello'
    );
    
    expect(result.exitCode).not.toBe(0);
    expect(result.stderr).toContain('docker');
    // Should show helpful error if Task #2 (runtime warning) is implemented
  });

  test('docker-compose should not be available', async () => {
    const result = await runAwf(
      ['--allow-domains', 'github.com'],
      'which docker-compose'
    );
    
    expect(result.exitCode).not.toBe(0);
  });

  test('verify docker socket is not mounted', async () => {
    const result = await runAwf(
      ['--allow-domains', 'github.com'],
      'test -S /var/run/docker.sock && echo "mounted" || echo "not mounted"'
    );
    
    expect(result.exitCode).toBe(0);
    expect(result.stdout).toContain('not mounted');
  });
});

Additional Verification

Update existing integration tests to ensure they don't depend on Docker functionality.

Expected Behavior

All tests should pass, confirming that:

1. docker-cli is not installed in agent container
2. Docker socket is not mounted
3. Commands fail with appropriate error codes
4. Helpful error messages are shown (if Task Secret proxying #2 is implemented)

References

• PR feat: remove Docker-in-Docker support #205: feat: remove Docker-in-Docker support #205
• Deleted test file for reference: tests/integration/docker-egress.test.ts (349 lines)
• Related: Task Secret proxying #2 (runtime warning implementation)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[github-actions]

Test Coverage Report

Metric	Coverage	Covered/Total
Lines	77.19%	1300/1684
Statements	77.27%	1333/1725
Functions	77.17%	142/184
Branches	69.76%	450/645

Coverage Thresholds

The project has the following coverage thresholds configured:

• Lines: 38%
• Statements: 38%
• Functions: 35%
• Branches: 30%

---

Coverage report generated by `npm run test:coverage`

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

Smoke Test Results

Last 2 Merged PRs:

• fix(deps): resolve docs npm audit
• chore: remove security fix status file

Test Results:

• ✅ GitHub MCP: Successfully retrieved PR data
• ✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-21050689031.txt
• ✅ Bash Tool: Verified file content

Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #223 🗺️