fix: add Drop for Capture, DGRAM SO_TYPE test, fix fd leak

Signed-off-by: danbugs <danilochiarlone@gmail.com>

Author: danbugs

host/src/lib.rs

@@ -2818,14 +2818,11 @@ mod tests {
 
     #[test]
     fn test_fs_read_bytes_capped() {
-        // Request a huge len (well above MAX_FS_READ) on a small file.
-        // Without the cap this would try to allocate terabytes and OOM.
         let root = tmpdir("readcap");
         fs::write(root.join("small.bin"), b"hello").unwrap();
         let mut reg = ToolRegistry::new();
         FsSandbox::new(&root).unwrap().register(&mut reg);
 
-        // Ask for 1 TiB — the cap should silently clamp to MAX_FS_READ.
         let req = br#"{"name":"fs_read_bytes","args":{"path":"small.bin","len":1099511627776}}"#;
         let resp = reg.dispatch(req);
         let s = std::str::from_utf8(&resp).unwrap();
@@ -2835,14 +2832,8 @@ mod tests {
 
     #[test]
     fn test_sleep_capped() {
-        // Verify the cap constant and that sleeping with a huge value
-        // completes quickly (the cap brings it down to 60 s max, but we
-        // pass 0 to keep the test instant — the important thing is
-        // confirming the cap constant exists and has the right value).
         assert_eq!(MAX_SLEEP_NS, 60_000_000_000);
 
-        // Dispatch a sleep with ns=0 through the real handler to confirm
-        // the code path works.
         let mut tools = ToolRegistry::new();
         let exit_code = Arc::new(AtomicI32::new(0));
         register_internal_tools(&mut tools, &exit_code, None, None);
@@ -2852,4 +2843,27 @@ mod tests {
         let s = std::str::from_utf8(&resp).unwrap();
         assert!(!s.contains("\"error\""), "sleep(0) should succeed: {s}");
     }
+
+    #[test]
+    fn net_getsockopt_returns_correct_type_for_dgram() {
+        let mut reg = ToolRegistry::new();
+        let policy = NetworkPolicy::AllowAll;
+        register_net_tools(&mut reg, &policy, None);
+
+        let req = br#"{"name":"net_socket","args":{"family":2,"type":2}}"#;
+        let resp = std::str::from_utf8(&reg.dispatch(req)).unwrap().to_string();
+        let v: serde_json::Value = serde_json::from_str(&resp).unwrap();
+        let fd = v["result"]["fd"].as_u64().unwrap();
+
+        let req =
+            format!(r#"{{"name":"net_getsockopt","args":{{"fd":{fd},"level":1,"optname":3}}}}"#);
+        let resp = std::str::from_utf8(&reg.dispatch(req.as_bytes()))
+            .unwrap()
+            .to_string();
+        let v: serde_json::Value = serde_json::from_str(&resp).unwrap();
+        assert_eq!(
+            v["result"]["value"], 2,
+            "SO_TYPE should return 2 (DGRAM), got: {resp}"
+        );
+    }
 }

host/src/stderr_capture.rs

@@ -8,7 +8,7 @@
 mod imp {
     use anyhow::Result;
     use nix::unistd;
-    use std::os::fd::{AsRawFd, FromRawFd, IntoRawFd, OwnedFd};
+    use std::os::fd::{AsRawFd, FromRawFd, OwnedFd};
     use std::path::Path;
     use std::sync::{Mutex, MutexGuard};
 
@@ -18,7 +18,7 @@ mod imp {
     static STDERR_LOCK: Mutex<()> = Mutex::new(());
 
     pub struct Capture {
-        original_stderr: OwnedFd,
+        original_stderr: Option<OwnedFd>,
         _guard: MutexGuard<'static, ()>,
     }
 
@@ -27,23 +27,34 @@ mod imp {
             let guard = STDERR_LOCK
                 .lock()
                 .unwrap_or_else(|poisoned| poisoned.into_inner());
-            let capture_fd = std::fs::File::create(path)?.into_raw_fd();
-            let original_stderr_raw = unistd::dup(2)?;
-            unistd::dup2(capture_fd, 2)?;
-            unistd::close(capture_fd)?;
-            let original_stderr = unsafe { OwnedFd::from_raw_fd(original_stderr_raw) };
+            let capture_file = std::fs::File::create(path)?;
+            let original_stderr =
+                OwnedFd::from(unistd::dup(2).map(|fd| unsafe { OwnedFd::from_raw_fd(fd) })?);
+            unistd::dup2(capture_file.as_raw_fd(), 2)?;
+            // capture_file dropped here — its OwnedFd closes the fd via RAII
             Ok(Self {
-                original_stderr,
+                original_stderr: Some(original_stderr),
                 _guard: guard,
             })
         }
 
         pub fn restore(self) -> Result<()> {
-            unistd::dup2(self.original_stderr.as_raw_fd(), 2)?;
-            // _guard is dropped here, releasing STDERR_LOCK
+            if let Some(ref fd) = self.original_stderr {
+                unistd::dup2(fd.as_raw_fd(), 2)?;
+            }
+            // Drop restores via Drop impl if restore() wasn't called,
+            // but explicit call lets caller handle errors.
             Ok(())
         }
     }
+
+    impl Drop for Capture {
+        fn drop(&mut self) {
+            if let Some(ref fd) = self.original_stderr.take() {
+                let _ = unistd::dup2(fd.as_raw_fd(), 2);
+            }
+        }
+    }
 }
 
 #[cfg(windows)]