Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sandbox): per-session windows-acl write grant with dual-mode restricting lists and a private temp subdirectory

Browse Source
This commit is contained in:
Huanqi Cao
2026-08-08 17:29:43 +08:00
parent 91d3ed6c5a
commit abfb933620
40 changed files with 1239 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/pty/pty-local/tests/index.spec.ts
View File

@@ -176,7 +176,7 @@ describe('LocalPtyBackend startup rollback', () => {
expect(initialized).toHaveBeenCalledWith(undefined)
expect((ctx.sandbox as RecordingSandbox).calls).toEqual([{
argv: ['/bin/bash', '-i'],
policy: { mode: 'workspace-write', workspaceRoot: '/session-workspace' },
policy: { mode: 'workspace-write', workspaceRoot: '/session-workspace', sessionId: 'agent' },
}])
})

2
packages/pty/pty-local/tests/local.spec.ts
View File

@@ -124,7 +124,7 @@ describe('pty-local real shell', () => {
const created = await ctx.pty.spawn(agent, { type: 'shell' })
expect(sandbox.calls).toEqual([{
argv: ['/bin/bash', '--noprofile', '--norc', '-i'],
policy: { mode: 'workspace-write', workspaceRoot: realpathSync.native(root) },
policy: { mode: 'workspace-write', workspaceRoot: realpathSync.native(root), sessionId: 'agent-workspace-write' },
}])
await fiber.dispose()
expect(ctx.pty.listBackends()).toEqual([])