Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(landlock-run): address release review feedback

Browse Source
This commit is contained in:
Hypatia May
2026-08-06 13:50:48 +08:00
parent d1a8a79ed0
commit 10c1d77a4f
7 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
packages/bash/bash-sandbox/tests/landlock.e2e.ts
View File

@@ -13,14 +13,14 @@ import LocalSubprocessService from '@deepseek-ai/dsh-subprocess-local'
/**
* KEYLESS consumer-integration proof: the REAL `LocalSandboxProvider` (bwrap
* rung forced off, so the npm-distributed `landlock-run` confines) underneath the
* rung forced off, so the workspace `landlock-run` launcher confines) underneath the
* REAL `SandboxBashExecutor`, driven through the executor's public run/start
* paths. Verifies the WORLD (files exist or don't) plus the stamped result
* facts; the backend-only confinement proofs live with
* `@deepseek-ai/dsh-sandbox-local`.
*
* Self-skips when the running kernel does not enforce Landlock; the
* launcher binary itself arrives with `pnpm install` (`node-addon-landlock-run`).
* Self-skips when the running kernel does not enforce Landlock. CI builds the launcher from
* `native/landlock-run` before running this file.
*/
const probe = spawnSync(launcherPath(), ['--probe'], { timeout: 5_000, encoding: 'utf8' })

6
packages/sandbox/sandbox-local/tests/packed-install.e2e.ts
View File

@@ -9,8 +9,10 @@ import { afterAll, beforeAll, describe, expect, it } from 'vitest'
/**
* Keyless publish-path rehearsal. It packs the provider, its workspace peers, and the current
* repository's Landlock entry/platform packages, then installs those exact tarballs in an external
* plain-Node consumer. No registry copy, tsx, path mapping, or workspace resolution can hide
* missing files, dependency errors, or lost executable modes.
* plain-Node consumer. The host launcher comes from the exact local tarballs, so no registry copy,
* tsx, path mapping, or workspace resolution can hide missing files, dependency errors, or lost
* executable modes. npm may still query registry metadata for an incompatible optional platform
* package that cannot supply the host launcher.
*
* The installed launcher must match the host architecture, remain executable, and either confine a
* real process with bwrap disabled or fail closed on a non-enforcing kernel. Skips off Linux or