v0.1.0

.config/nextest.toml

@@ -0,0 +1,26 @@
+# Nextest configuration file
+# https://nexte.st/book/configuration
+
+[profile.default]
+# Stop test run after 5 failures
+fail-fast = { max-fail = 5 }
+
+# Test output settings
+success-output = "never"
+status-level = "pass"
+
+# Retry settings
+retries = { backoff = "fixed", count = 0 }
+
+# Timeout settings
+slow-timeout = { period = "60s", terminate-after = 2 }
+
+[profile.ci]
+# CI-specific configuration (inherits from default)
+# More verbose output for debugging CI failures
+failure-output = "final"
+success-output = "never"
+status-level = "retry"
+
+# Allow more retries in CI for flaky tests
+retries = { backoff = "exponential", count = 2, delay = "1s", max-delay = "10s" }

.github/workflows/tests.yml

@@ -2,9 +2,7 @@ name: Tests
 
 on:
   push:
-    branches: [main]
   pull_request:
-    branches: [main]
 
 env:
   CARGO_TERM_COLOR: always
@@ -26,21 +24,24 @@ jobs:
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@v2
 
+      - name: Install nextest
+        uses: taiki-e/install-action@nextest
+
       - name: Build
         run: cargo build --verbose
 
       - name: Run unit tests
-        run: cargo test --bins --verbose
+        run: cargo nextest run --profile ci --bins --verbose
 
       - name: Run smoke tests
-        run: cargo test --test smoke_test --verbose
+        run: cargo nextest run --profile ci --test smoke_test --verbose
 
       - name: Run macOS integration tests (with sudo)
         run: |
           # The tests require root privileges for PF rules on macOS
           # GitHub Actions provides passwordless sudo on macOS runners
-          # Use -E to preserve environment and full path to cargo
-          sudo -E $(which cargo) test --test macos_integration --verbose
+          # Use -E to preserve environment and full path to cargo and nextest
+          sudo -E $(which cargo) nextest run --profile ci --test macos_integration --verbose
 
   test-linux:
     name: Linux Tests
@@ -60,38 +61,37 @@ jobs:
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@v2
 
+      - name: Install nextest
+        uses: taiki-e/install-action@nextest
+
       - name: Build
         run: cargo build --verbose
 
       - name: Run unit tests
-        run: cargo test --bins --verbose
+        run: cargo nextest run --profile ci --bins --verbose
 
       - name: Run smoke tests
-        run: cargo test --test smoke_test --verbose
-
-      - name: Run jail integration tests
-        run: cargo test --test jail_integration --verbose
+        run: cargo nextest run --profile ci --test smoke_test --verbose
 
       - name: Debug TLS environment
         run: |
           echo "=== Debugging TLS/Certificate Environment ==="
           chmod +x scripts/debug_tls_env.sh
           ./scripts/debug_tls_env.sh
           sudo ./scripts/debug_tls_env.sh
-          echo "=== End TLS Debug ==="
 
       - name: Run Linux jail integration tests (with sudo)
         run: |
           # Ensure ip netns support is available
           sudo ip netns list || true
           # Run the Linux-specific jail tests with root privileges
-          # Use full path to cargo since sudo doesn't preserve PATH
-          sudo -E $(which cargo) test --test linux_integration --verbose
+          # Use full path to cargo and nextest since sudo doesn't preserve PATH
+          sudo -E $(which cargo) nextest run --profile ci --test linux_integration --verbose
 
   test-weak:
     name: Weak Mode Integration Tests (Linux)
     runs-on: ubuntu-latest
-    
+
     steps:
       - uses: actions/checkout@v4
 
@@ -103,15 +103,21 @@ jobs:
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@v2
 
+      - name: Install nextest
+        uses: taiki-e/install-action@nextest
+
       - name: Build
         run: cargo build --verbose
 
       - name: Run weak mode integration tests
-        run: cargo test --test weak_integration --verbose
+        run: cargo nextest run --profile ci --test weak_integration --verbose
 
   clippy:
-    name: Clippy
-    runs-on: ubuntu-latest
+    name: Clippy (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
 
     steps:
       - uses: actions/checkout@v4
@@ -126,7 +132,7 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Run clippy
-        run: cargo clippy -- -D warnings
+        run: cargo clippy --all-targets -- -D warnings
 
   fmt:
     name: Format

.gitignore

@@ -1 +1,4 @@
 target/
+
+# Local Claude Code instructions (not committed to repo)
+CLAUDE.local.md

Cargo.toml

@@ -30,6 +30,7 @@ dirs = "6.0.0"
 hyper-rustls = "0.27.7"
 tls-parser = "0.12.2"
 camino = "1.1.11"
+filetime = "0.2"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 nix = { version = "0.27", features = ["user"] }

README.md

@@ -19,6 +19,7 @@ A cross-platform tool for monitoring and restricting HTTP/HTTPS requests from pr
 - [ ] Expand test cases to include WebSockets
 - [ ] Add Linux support with parity with macOS
 - [ ] Add robust firewall cleanup mechanism for Linux and macOS
+- [ ] Support/test concurrent jailing across macOS and Linux
 
 ## Quick Start
 

src/jail/linux/iptables.rs

@@ -16,6 +16,17 @@ pub struct IPTablesRule {
 }
 
 impl IPTablesRule {
+    /// Create a rule object for an existing rule (for cleanup purposes)
+    /// This doesn't add the rule, but will remove it when dropped
+    pub fn new_existing(table: Option<&str>, chain: &str, rule_spec: Vec<&str>) -> Self {
+        Self {
+            table: table.map(|s| s.to_string()),
+            chain: chain.to_string(),
+            rule_spec: rule_spec.iter().map(|s| s.to_string()).collect(),
+            added: true, // Mark as added so it will be removed on drop
+        }
+    }
+
     /// Create and add a new iptables rule
     pub fn new(table: Option<&str>, chain: &str, rule_spec: Vec<&str>) -> Result<Self> {
         let mut args = Vec::new();