refactor(dynamic): improve fallback handling for sandbox restrictions, centralize and enhance stub initialization, and expand test coverage across harnesses

src/dynamic/stubs/http.rs

@@ -68,16 +68,26 @@ impl HttpStub {
     /// back to the process-wide temp directory when `workdir` is not
     /// writable.
     pub fn start(workdir: &Path) -> std::io::Result<Self> {
-        let listener = TcpListener::bind("127.0.0.1:0")?;
-        listener.set_nonblocking(false)?;
-        let port = listener.local_addr()?.port();
-
         let events: Arc<Mutex<Vec<StubEvent>>> = Arc::new(Mutex::new(Vec::new()));
         let shutdown = Arc::new(AtomicBool::new(false));
 
-        let events_clone = Arc::clone(&events);
-        let shutdown_clone = Arc::clone(&shutdown);
-        std::thread::spawn(move || accept_loop(listener, events_clone, shutdown_clone));
+        let port = match TcpListener::bind("127.0.0.1:0") {
+            Ok(listener) => {
+                listener.set_nonblocking(false)?;
+                let port = listener.local_addr()?.port();
+                let events_clone = Arc::clone(&events);
+                let shutdown_clone = Arc::clone(&shutdown);
+                std::thread::spawn(move || accept_loop(listener, events_clone, shutdown_clone));
+                port
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied => {
+                // Some host sandboxes deny loopback binds. Keep the
+                // side-channel recorder alive so generated shims can
+                // still surface attempted outbound calls deterministically.
+                0
+            }
+            Err(e) => return Err(e),
+        };
 
         let tempdir = TempDir::new_in(workdir).or_else(|_| TempDir::new())?;
         let log_path = tempdir.path().join("nyx_http_stub.requests.log");
@@ -343,6 +353,9 @@ mod tests {
         let Some((_dir, stub)) = start_stub() else {
             return;
         };
+        if stub.port() == 0 {
+            return;
+        }
         let reply = send_request(
             stub.port(),
             b"GET /api/users HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n",
@@ -364,6 +377,9 @@ mod tests {
         let Some((_dir, stub)) = start_stub() else {
             return;
         };
+        if stub.port() == 0 {
+            return;
+        }
         let body = b"username=admin&password=hunter2";
         let req = format!(
             "POST /login HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Length: {}\r\n\r\n",