fix(sandbox): omit --user when os.getuid is unavailable

[kurosawareiji7007-hub]

what changed

sandbox docker argv only adds --user uid:gid when os.getuid / os.getgid exist. on windows the flag is omitted so argv construction no longer raises.

why

sandboxed dual-solve crashed with AttributeError on windows before docker ever ran (#582).

validation

python -m pytest tests/test_sandbox.py -q
python -m ruff check src/vouch/sandbox.py tests/test_sandbox.py
python -m mypy src/vouch/sandbox.py

Fixes #582

Summary by CodeRabbit

• Bug Fixes

  • Fixed sandboxed Docker command generation on Windows and other environments where user and group ID functions are unavailable.
  • Docker commands now omit the optional user mapping when those system details cannot be retrieved, preventing command-building failures.

• Documentation

  • Updated the unreleased changelog to document the platform-specific fix.

[coderabbitai]

Walkthrough

Changes

Sandbox Docker argv

Layer / File(s)	Summary
Conditional Docker user flag src/vouch/sandbox.py	Docker argv construction adds --user UID:GID only when both UID/GID functions are available and callable.
Platform-specific regression coverage tests/test_sandbox.py, CHANGELOG.md	Tests cover available and unavailable UID/GID functions, and the changelog records the Windows-specific fix.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: plind-junior

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main sandbox fix: omitting --user when os.getuid is unavailable.
Linked Issues check	✅ Passed	The code and tests address the Windows crash by skipping --user when getuid/getgid are missing, matching issue #582.
Out of Scope Changes check	✅ Passed	The changes stay focused on sandbox Docker argv handling, a matching test, and a brief changelog note.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/test_sandbox.py`:
- Around line 57-61: Update the test around the sandbox user-argument assertions
to use callable(getattr(...)) for both os.getuid and os.getgid, matching the
implementation’s availability check. Parameterize the regression cases so getuid
and getgid are removed or made unavailable independently, covering each
partial-availability combination instead of only removing both together.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 99446498-5cb8-431c-a2e0-532b5a260b2a

📥 Commits

Reviewing files that changed from the base of the PR and between 1fe8fb5 and 874651c.

📒 Files selected for processing (3)

• CHANGELOG.md
• src/vouch/sandbox.py
• tests/test_sandbox.py

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

make the test matrix match the implementation’s availability check

The implementation checks that both functions are callable, but the existing assertion only uses hasattr, and the regression test removes both functions together. This misses cases where only getuid or getgid is unavailable or non-callable. Use the same callable(getattr(...)) predicate and parameterize the regression for each function independently.

Also applies to: 78-85

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_sandbox.py` around lines 57 - 61, Update the test around the
sandbox user-argument assertions to use callable(getattr(...)) for both
os.getuid and os.getgid, matching the implementation’s availability check.
Parameterize the regression cases so getuid and getgid are removed or made
unavailable independently, covering each partial-availability combination
instead of only removing both together.