Merge remote-tracking branch 'origin/feat/windows-pwsh-default' into feat/windows-acl-sandbox

# Conflicts: # apps/cli/reference/README.i18n.yaml # knip.json # packages/sandbox/sandbox-local/package.json # pnpm-lock.yaml # scripts/check-workspace-constraints.ts
2026-08-08 17:50:39 +08:00
parent 07c7e2f0bd d1b080a68d
commit cc64c729db
841 changed files with 13282 additions and 5966 deletions
--- a/packages/sandbox/sandbox-local/README.i18n.yaml
+++ b/packages/sandbox/sandbox-local/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/sandbox/sandbox-local/README.md
-README.md: f6a1cc2b3e454e0670a564151d41182ec515bdcf
-README.zh.md: 18b66af350932fc8d5c4f184d0e7fa049f910250
+README.md: 23d3a32451c105c71c0a7399ed051288b70753f3
+README.zh.md: 165a6fc88a9fdd219c3ddb016cdf415504556d8c
--- a/packages/sandbox/sandbox-local/README.md
+++ b/packages/sandbox/sandbox-local/README.md
@@ -12,7 +12,7 @@ Policy is per call; the provider stores only the mechanism and cached runner ver

 The Seatbelt profile is allow-default with `(deny file-write*)` plus write allow-lists, so exactly the mode's promised file effects are governed: `read-only` grants the `/dev/null` literal alone; `workspace-write` adds the workspace root, `/tmp`, and the per-user darwin temp dir (`os.tmpdir()` — the platform's real temp area for mkstemp-family tools), every root canonicalized because Seatbelt matches resolved paths (`/tmp` IS `/private/tmp`). Apple marks the `sandbox-exec` CLI deprecated but ships it on every macOS; the functional probe is what fails closed if that ever changes.

-[`node-addon-landlock-run`](https://www.npmjs.com/package/node-addon-landlock-run) supplies the platform launcher, functional probe, and CLI argument vocabulary. This provider owns only mode-to-grant mapping and runner selection. Keeping path resolution and probe parsing with the versioned binary prevents contract drift.
+[`@deepseek-ai/node-addon-landlock-run`](https://www.npmjs.com/package/@deepseek-ai/node-addon-landlock-run) supplies the platform launcher, functional probe, and CLI argument vocabulary. This provider owns only mode-to-grant mapping and runner selection. Keeping path resolution and probe parsing with the versioned binary prevents contract drift.

 ```yaml
 - id: sandbox
--- a/packages/sandbox/sandbox-local/README.zh.md
+++ b/packages/sandbox/sandbox-local/README.zh.md
@@ -12,7 +12,7 @@

 Seatbelt profile 默认允许，但带 `(deny file-write*)` 和写入 allow-list，因此恰好约束相应模式承诺的文件操作：`read-only` 只授予 `/dev/null` 字面路径；`workspace-write` 另加工作区根目录、`/tmp` 和逐用户 darwin 临时目录（`os.tmpdir()`，即平台供 mkstemp 家族工具使用的真实临时区域）。每个根目录都经过规范化，因为 Seatbelt 匹配解析后的路径（`/tmp` 就是 `/private/tmp`）。Apple 将 `sandbox-exec` CLI（命令行界面）标为 deprecated，但所有 macOS 系统仍会提供它；若情况发生变化，功能探测会使执行被拒绝。

-[`node-addon-landlock-run`](https://www.npmjs.com/package/node-addon-landlock-run)提供平台 launcher、功能探测和 CLI 参数词汇。该提供方只负责模式到授权的映射与 runner 选择。把路径解析和探测解析保留在带版本的 binary 中，可防止契约漂移。
+[`@deepseek-ai/node-addon-landlock-run`](https://www.npmjs.com/package/@deepseek-ai/node-addon-landlock-run)提供平台 launcher、功能探测和 CLI 参数词汇。该提供方只负责模式到授权的映射与 runner 选择。把路径解析和探测解析保留在带版本的 binary 中，可防止契约漂移。

 ```yaml
 - id: sandbox
--- a/packages/sandbox/sandbox-local/package.json
+++ b/packages/sandbox/sandbox-local/package.json
@@ -33,7 +33,7 @@
  },
  "dependencies": {
    "@deepseek-ai/dsh-sandbox-windows-acl": "workspace:^",
-    "node-addon-landlock-run": "0.0.0-test.0",
+    "@deepseek-ai/node-addon-landlock-run": "workspace:*",
    "schemastery": "^3.18.0"
  },
  "devDependencies": {
--- a/packages/sandbox/sandbox-local/src/index.ts
+++ b/packages/sandbox/sandbox-local/src/index.ts
@@ -23,7 +23,7 @@ import {
  LAUNCHER_FAILURE_EXIT,
  launcherPath as landlockLauncherPath,
  probe as defaultProbeLandlock,
-} from 'node-addon-landlock-run'
+} from '@deepseek-ai/node-addon-landlock-run'
 import { Context } from 'cordis'
 import z from 'schemastery'
 import { assertNever } from '@deepseek-ai/dsh-llm'
--- a/packages/sandbox/sandbox-local/src/profiles.ts
+++ b/packages/sandbox/sandbox-local/src/profiles.ts
@@ -4,7 +4,7 @@
 * @module @deepseek-ai/dsh-sandbox-local/profiles
 */

-import { grantArgs as landlockGrantArgs } from 'node-addon-landlock-run'
+import { grantArgs as landlockGrantArgs } from '@deepseek-ai/node-addon-landlock-run'
 import { writableRoots } from '@deepseek-ai/dsh-sandbox'
 import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox'

--- a/packages/sandbox/sandbox-local/tests/landlock.e2e.ts
+++ b/packages/sandbox/sandbox-local/tests/landlock.e2e.ts
@@ -6,11 +6,11 @@ import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
 import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox'
-import { launcherPath } from 'node-addon-landlock-run'
+import { launcherPath } from '@deepseek-ai/node-addon-landlock-run'
 import { LocalSandboxProvider } from '@deepseek-ai/dsh-sandbox-local'

 /**
- * Keyless backend integration through `confine()` and the registry `landlock-run` launcher, with
+ * Keyless backend integration through `confine()` and the workspace `landlock-run` launcher, with
 * bwrap forced off. Tests assert real world effects; consumer coverage lives in dsh-bash-sandbox.
 * Skips when the platform package or enforcing kernel is unavailable. HOME-based workspaces avoid
 * Landlock's wholesale `/tmp` grant, so workspace-write proves the workspace-root grant itself.
--- a/packages/sandbox/sandbox-local/tests/local.spec.ts
+++ b/packages/sandbox/sandbox-local/tests/local.spec.ts
@@ -12,7 +12,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
-import { LAUNCHER_FAILURE_EXIT } from 'node-addon-landlock-run'
+import { LAUNCHER_FAILURE_EXIT } from '@deepseek-ai/node-addon-landlock-run'
 import { SANDBOX_UNAVAILABLE, SandboxUnavailableError } from '@deepseek-ai/dsh-sandbox'
 import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox'
 import {
--- a/packages/sandbox/sandbox-local/tests/packed-install.e2e.ts
+++ b/packages/sandbox/sandbox-local/tests/packed-install.e2e.ts
@@ -7,20 +7,25 @@ import { fileURLToPath } from 'node:url'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'

 /**
- * Keyless publish-path rehearsal. It packs the package and workspace peers, installs those exact
- * tarballs in an external plain-Node consumer, and lets npm resolve the registry Landlock launcher
- * plus its platform package. No tsx, path mapping, or workspace resolution can hide missing files,
- * dependency errors, or lost executable modes.
+ * Keyless publish-path rehearsal. It packs the provider, its workspace peers, and the current
+ * repository's Landlock entry/platform packages, then installs those exact tarballs in an external
+ * plain-Node consumer. The host launcher comes from the exact local tarballs, so no registry copy,
+ * tsx, path mapping, or workspace resolution can hide missing files, dependency errors, or lost
+ * executable modes. npm may still query registry metadata for an incompatible optional platform
+ * package that cannot supply the host launcher.
 *
 * The installed launcher must match the host architecture, remain executable, and either confine a
 * real process with bwrap disabled or fail closed on a non-enforcing kernel. Skips off Linux or
- * before `pnpm run build`; launcher byte provenance belongs to its upstream release pipeline.
+ * before the harness and native packages are built.
 */

 const packageDir = fileURLToPath(new URL('..', import.meta.url))
 const repoRoot = fileURLToPath(new URL('../../../..', import.meta.url))
+const nativeDir = join(repoRoot, 'native/landlock-run')
+const sourceLauncher = join(nativeDir, 'packages', `linux-${process.arch}`, 'bin', 'landlock-run')
+const platformPackageName = `@deepseek-ai/node-addon-landlock-run-linux-${process.arch}`

-/** The closure the consumer needs: the package and its transitive `@deepseek-ai` peers; the launcher family arrives from the registry. */
+/** The harness closure the consumer needs; native tarballs are packed through their mode-preserving release script. */
 const WORKSPACE_CLOSURE = [
  'packages/sandbox/sandbox-local',
  // sandbox-local's win32 chain rung is a runtime dependency: a packed
@@ -40,6 +45,8 @@ const E_MACHINE = { x64: 62, arm64: 183 }[process.arch as 'x64' | 'arm64']
 const packable = process.platform === 'linux'
  && E_MACHINE !== undefined
  && existsSync(join(packageDir, 'lib', 'index.js'))
+  && existsSync(join(nativeDir, 'packages/entry/lib/index.js'))
+  && existsSync(sourceLauncher)

 let consumerDir = ''
 let workDir = ''
@@ -61,7 +68,20 @@ describe.skipIf(!packable)('sandbox-local: packed-tarball distribution (publish-
    consumerDir = mkdtempSync(join(tmpdir(), 'dsh-packed-consumer-'))
    workDir = mkdtempSync(join(tmpdir(), 'dsh-packed-work-'))

-    // Pack each closure member with the exact bytes publish would upload.
+    const nativePackDest = join(packDest, 'native')
+    const nativePack = spawnSync('node', ['./scripts/pack-release.mjs', nativePackDest, '--current-platform-only'], {
+      cwd: nativeDir,
+      encoding: 'utf8',
+      timeout: 120_000,
+    })
+    expect(nativePack.status, `native pack failed:\n${nativePack.stdout}\n${nativePack.stderr}`).toBe(0)
+
+    const nativeTarballs = readFileSync(join(nativePackDest, 'publish-order.txt'), 'utf8')
+      .trim()
+      .split('\n')
+      .map(tarball => join(nativePackDest, tarball))
+
+    // Pack each harness closure member with the exact bytes publish would upload.
    const tarballs: string[] = []
    for (const pkg of WORKSPACE_CLOSURE) {
      const pack = spawnSync('pnpm', ['pack', '--pack-destination', packDest], {
@@ -73,6 +93,7 @@ describe.skipIf(!packable)('sandbox-local: packed-tarball distribution (publish-
      const lines = pack.stdout.trim().split('\n')
      tarballs.push(lines[lines.length - 1] as string)
    }
+    tarballs.push(...nativeTarballs)

    // Peer ranges resolve to the tarballs; Cordis is pinned to their peer range. Do not omit optional
    // dependencies because the launcher selects its OS/CPU package through one.
@@ -92,7 +113,7 @@ describe.skipIf(!packable)('sandbox-local: packed-tarball distribution (publish-
      import { spawnSync } from 'node:child_process'
      import { existsSync } from 'node:fs'
      import { Context } from 'cordis'
-      import { launcherPath } from 'node-addon-landlock-run'
+      import { launcherPath } from '@deepseek-ai/node-addon-landlock-run'
      import { LocalSandboxProvider } from '@deepseek-ai/dsh-sandbox-local'
      const ctx = new Context()
      await ctx.plugin(LocalSandboxProvider, {})
@@ -128,18 +149,19 @@ describe.skipIf(!packable)('sandbox-local: packed-tarball distribution (publish-
    await Promise.all([consumerDir, workDir].filter(Boolean).map(dir => rm(dir, { recursive: true, force: true })))
  })

-  it('installs the registry launcher for this host: present, EXECUTABLE, right ELF arch', () => {
-    const installed = join(consumerDir, 'node_modules', `node-addon-landlock-run-linux-${process.arch}`, 'bin', 'landlock-run')
+  it('installs this checkout\'s launcher for the host: present, executable, byte-identical, and right ELF arch', () => {
+    const installed = join(consumerDir, 'node_modules', ...platformPackageName.split('/'), 'bin', 'landlock-run')
    expect(existsSync(installed), 'platform package missing from the installed tree').toBe(true)
    // A tarball or extraction step that strips the mode bit would leave the
    // probe failing exactly like a non-enforcing kernel — assert it apart.
    expect(() => { accessSync(installed, constants.X_OK) }, 'installed launcher is not executable').not.toThrow()
+    expect(readFileSync(installed), 'installed launcher bytes').toEqual(readFileSync(sourceLauncher))
    expect(readFileSync(installed).readUInt16LE(18), 'ELF e_machine').toBe(E_MACHINE)
  })

  it('the installed provider resolves the launcher INSIDE the consumer node_modules platform package', () => {
    expect(verdict.launcher)
-      .toBe(join(consumerDir, 'node_modules', `node-addon-landlock-run-linux-${process.arch}`, 'bin', 'landlock-run'))
+      .toBe(join(consumerDir, 'node_modules', ...platformPackageName.split('/'), 'bin', 'landlock-run'))
  })

  it('confines through the installed launcher (enforcing kernel) or fails closed (non-enforcing) — never unconfined', async () => {
--- a/packages/sandbox/sandbox-local/tsconfig.json
+++ b/packages/sandbox/sandbox-local/tsconfig.json
@@ -17,6 +17,9 @@
    {
      "path": "../../../vendor/schemastery"
    },
+    {
+      "path": "../../../native/landlock-run/packages/entry"
+    },
    {
      "path": "../../llm/llm"
    },