Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(sandbox): cross-link Landlock snapshot rule

Browse Source
This commit is contained in:
Hypatia May
2026-08-04 13:49:34 +08:00
parent f91aedd074
commit b0f33f13f4
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
examples/acp-agent/tests/fixtures/partial-landlock-sandbox.ts vendored
View File

@@ -3,7 +3,10 @@ import { SandboxProvider } from '@deepseek-ai/dsh-sandbox'
const NOTICE = 'landlock-run: partial enforcement (older Landlock ABI)' const NOTICE = 'landlock-run: partial enforcement (older Landlock ABI)'
/** Snapshot-only provider that reproduces an older-ABI Landlock launch. */ /**
* Snapshot-only provider that reproduces an older-ABI Landlock launch. Keep
* its failure tuple aligned with `sandbox-local`'s Landlock runner rule.
*/
export default class PartialLandlockSandboxProvider extends SandboxProvider { export default class PartialLandlockSandboxProvider extends SandboxProvider {
confine(argv: readonly string[], _policy: SandboxPolicy): ConfinedArgv { confine(argv: readonly string[], _policy: SandboxPolicy): ConfinedArgv {
return { return {

2
packages/sandbox/sandbox-local/src/index.ts
View File

@@ -151,6 +151,8 @@ const DENIAL_SIGNATURES = {
* fatal-line launcher-failure contract. Bubblewrap's current fatal paths exit * fatal-line launcher-failure contract. Bubblewrap's current fatal paths exit
* 1 but its public contract does not reserve that status, while sandbox-exec * 1 but its public contract does not reserve that status, while sandbox-exec
* publishes no launcher-failure status; those backends remain signature-only. * publishes no launcher-failure status; those backends remain signature-only.
* Keep the Landlock tuple aligned with the assembled snapshot fixture at
* `examples/acp-agent/tests/fixtures/partial-landlock-sandbox.ts`.
*/ */
const RUNNER_FAILURE_RULES = { const RUNNER_FAILURE_RULES = {
bwrap: [{ fatalSignatures: ['bwrap: '] }], bwrap: [{ fatalSignatures: ['bwrap: '] }],