Allow host runtimes to bypass the native builder sandbox

host/src/builder/tests.rs

@@ -1,5 +1,16 @@
 //! Focused tests for source discovery, argument forwarding, eviction, and process cancellation.
 use super::*;
+#[test]
+fn native_command_defaults_to_bwrap_and_can_bypass_it() -> Result<()> {
+    let temp = tempfile::tempdir()?;
+    let world = crate::world::World::open(temp.path())?;
+    assert!(!crate::process::RuntimeOptions::default().no_builder_sandbox);
+    let default = Builder::new(world.root.clone(), &world.host_dir)?;
+    assert_eq!(default.command().as_std().get_program(), "bwrap");
+    let direct = Builder::new_with_options(world.root, &world.host_dir, true)?;
+    assert_eq!(direct.command().as_std().get_program(), "cargo");
+    Ok(())
+}
 #[tokio::test]
 async fn source_links_survive_round_trip() -> Result<()> {
     let temp = tempfile::tempdir()?;